Python ImpactDecoder.LinuxSLLDecoder类代码示例

    def __init__(self, pcapObj):
        # Query the type of the link and instantiate a decoder accordingly.
        datalink = pcapObj.datalink()
        if pcapy.DLT_EN10MB == datalink:
            self.decoder = EthDecoder()
        elif pcapy.DLT_LINUX_SLL == datalink:
            self.decoder = LinuxSLLDecoder()
        else:
            raise Exception("Datalink type not supported: " % datalink)

        self.pcap = pcapObj
        self.connections = {}

	def __init__(self, pcapy_object):
		""" PacketLoop(Thread) Class Constructor """
		datalink = pcapy_object.datalink()
		if pcapy.DLT_EN10MB == datalink:
			self.decoder = EthDecoder()
		elif pcapy.DLT_LINUX_SLL == datalink:
			self.decoder = LinuxSLLDecoder()
		else:
			print "Datalink type not supported: " % datalink
			exit()
		self.pcap	=	pcapy_object
		Thread.__init__(self)
		self.stop	= False

 def __init__(self, pcapReader, dstIp, dstPort):
     self.socket_ = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
     self.dest = (dstIp, dstPort)
     # Query datalink type and instantiate the corresponding decoder
     datalink = pcapReader.datalink()
     if datalink == pcapy.DLT_EN10MB:
         self.decoder = EthDecoder()
     elif datalink == pcapy.DLT_LINUX_SLL:
         self.decoder = LinuxSLLDecoder()
     else:
         raise Exception("Datalink type not supported");
     self.pcapReader = pcapReader
     self.counter = 0

    def __init__(self, pcapObj,subnet,arptable):
        # Query the type of the link and instantiate a decoder accordingly.
        datalink = pcapObj.datalink()
        if pcapy.DLT_EN10MB == datalink:
            self.decoder = EthDecoder()
        elif pcapy.DLT_LINUX_SLL == datalink:
            self.decoder = LinuxSLLDecoder()
        else:
            raise Exception("Datalink type not supported: " % datalink)

        self.pcap = pcapObj
        self.subnet = subnet
        self.arptable = arptable
        Thread.__init__(self)

class DecoderThread(Thread):
    """A thread to sniff packets on my machine,
    read the SYN number and send it to the peer"""
    
    def __init__(self, pcapObj, udp_obj):
        self.udp_obj = udp_obj
        # Query the type of the link and instantiate a decoder accordingly.
        datalink = pcapObj.datalink()
        if pcapy.DLT_EN10MB == datalink:
            self.decoder = EthDecoder()
        elif pcapy.DLT_LINUX_SLL == datalink:
            self.decoder = LinuxSLLDecoder()
        else:
            raise Exception("Datalink type not supported: " % datalink)

        self.pcap = pcapObj
        Thread.__init__(self)

    def run(self):
        # Sniff ad infinitum.
        # PacketHandler shall be invoked by pcap for every packet.
        self.pcap.loop(1, self.packetHandler)

    def packetHandler(self, hdr, data):
        # Use the ImpactDecoder to turn the rawpacket into a hierarchy
        # of ImpactPacket instances.
        # Display the packet in human-readable form.
        try:
            packet = self.decoder.decode(data)
            #print 'Try to send SYN...'
            syn = packet.child().child().get_th_seq()
            self.udp_obj.send_SYN_to_ConnectionBroker(syn)
        except:
            print "Unexpected error:", sys.exc_info()[0], sys.exc_info()[1]

class OSCServer(Thread) :
    def __init__(self, callback, dev='any', port = 3333, ignoreIp = None) :
        Thread.__init__(self)
        DEV          = dev  # interface to listen on
	MAX_LEN      = 1514    # max size of packet to capture
	PROMISCUOUS  = 1       # promiscuous mode?
	READ_TIMEOUT = 100     # in milliseconds
	self.MAX_PKTS     = -1      # number of packets to capture; -1 => no limit
	self.p = open_live(DEV, MAX_LEN, PROMISCUOUS, READ_TIMEOUT)
	myfilter = 'udp and port '+str(port)
	if ignoreIp:
		myfilter+=' and not dst host '+ignoreIp
	self.p.setfilter(myfilter)
	self.callback = callback
	self.packets = 0
	datalink = self.p.datalink()
        if pcapy.DLT_EN10MB == datalink:
            self.decoder = EthDecoder()
        elif pcapy.DLT_LINUX_SLL == datalink:
            self.decoder = LinuxSLLDecoder()
        else:
            raise Exception("Datalink type not supported: " % datalink)
            
    def ph(self,hdr, data):
	p = self.decoder.decode(data)
        ip = p.child()
        udp = ip.child()
        self.packets+=1
        self.callback( udp.get_data_as_string())
            
    def run(self) :
    	self.p.loop(self.MAX_PKTS,self.ph)

    def __init__(self, pcapObj):
        # Query the type of the link and instantiate a decoder accordingly.
        self.proto_id = None
        self.src_ip = None
        self.tgt_ip = None
        self.src_port = None
        self.tgt_port = None
        self.msgs = [] # error msgs
        datalink = pcapObj.datalink()
        if pcapy.DLT_EN10MB == datalink:
            self.decoder = EthDecoder()
        elif pcapy.DLT_LINUX_SLL == datalink:
            self.decoder = LinuxSLLDecoder()
        else:
            raise Exception("Datalink type not supported: " % datalink)

        self.pcap = pcapObj
        self.connections = []

class Decoder:
    def __init__(self, pcapObj):
        # Query the type of the link and instantiate a decoder accordingly.
        datalink = pcapObj.datalink()
        if pcapy.DLT_EN10MB == datalink:
            self.decoder = EthDecoder()
        elif pcapy.DLT_LINUX_SLL == datalink:
            self.decoder = LinuxSLLDecoder()
        else:
            raise Exception("Datalink type not supported: " % datalink)

        self.pcap = pcapObj
        self.connections = {}

    def start(self):
        # Sniff ad infinitum.
        # PacketHandler shall be invoked by pcap for every packet.
        self.pcap.loop(0, self.packetHandler)

    def packetHandler(self, hdr, data):
        # Use the ImpactDecoder to turn the rawpacket into a hierarchy
        # of ImpactPacket instances.
        try:
            p = self.decoder.decode(data)
            ip = p.child()
            protocol = ip.get_ip_p()
            # Build a distinctive key for this pair of peers.
            if protocol == 6:
                tcp = ip.child()
                proto = 'TCP'
                src = (ip.get_ip_src(), tcp.get_th_sport())
                dst = (ip.get_ip_dst(), tcp.get_th_dport())
                con = Connection(proto, src, dst)
            elif protocol == 17:
                udp = ip.child()
                proto = 'UDP'
                src = (ip.get_ip_src(), udp.get_uh_sport())
                dst = (ip.get_ip_dst(), udp.get_uh_dport())
                con = Connection(proto, src, dst)

            # If there isn't an entry associated yetwith this connection,
            # open a new pcapdumper and create an association.
            if not self.connections.has_key(con):
                fn = con.getFilename()
                print "Found a new connection, storing into:", fn
                try:
                    dumper = self.pcap.dump_open(fn)
                except pcapy.PcapError, e:
                    print "Can't write packet to:", fn
                    return
                self.connections[con] = dumper

            # Write the packet to the corresponding file.
            self.connections[con].dump(hdr, data)
        except Exception as e:
            print str(e)
            pass

    def __init__(self, bridge, subnet, arptable):
        # Open interface for capturing.
        self.pcap = open_live(bridge.bridgename, 65536, 1, 100)

        # Query the type of the link and instantiate a decoder accordingly.
        datalink = self.pcap.datalink()
        if pcapy.DLT_EN10MB == datalink:
            self.decoder = EthDecoder()
        elif pcapy.DLT_LINUX_SLL == datalink:
            self.decoder = LinuxSLLDecoder()
        else:
            raise Exception("Datalink type not supported: " % datalink)

        self.bridge = bridge
        self.subnet = subnet
        self.arptable = arptable
        self.protocols = args.discovery_protos or self.protocols

        Thread.__init__(self)

 def __init__(self, pcapObj):
     self.searchTerm = 'commands'
     self.hostDict = {}
     self.flowDict = {}
     self.arbitraryChunkedLength = 30000 # as length of chunked tranfers can not be measured, we will provide an artibrary length for now
     # OSC functionality (multicasting for now)
     sendAddress = '127.0.0.1', 57120
     self.oscClient=OSCClient()
     self.oscClient.connect(sendAddress)
     # Query the type of the link and instantiate a decoder accordingly.
     datalink = pcapObj.datalink()
     if pcapy.DLT_EN10MB == datalink:
         self.decoder = EthDecoder()
     elif pcapy.DLT_LINUX_SLL == datalink:
         self.decoder = LinuxSLLDecoder()
     else:
         raise Exception("Datalink type not supported: " % datalink)
     self.pcap = pcapObj
     Thread.__init__(self)

    def __init__(self, pcapObj, filename=None):
        # Query the type of the link and instantiate a decoder accordingly.
        datalink = pcapObj.datalink()
        if pcapy.DLT_EN10MB == datalink:
            self.decoder = EthDecoder()
        elif pcapy.DLT_LINUX_SLL == datalink:
            self.decoder = LinuxSLLDecoder()
        else:
            raise Exception("Datalink type not supported: " % datalink)

        self.pcap = pcapObj
        self.connections = {}
        # added by yair
        self.packet_count = 0
        self.packet_list = []
        self.filename = filename
        self.dir = None

#         a dictionary containing all TCP streams
        self.streams = {}

class DecoderThread(Thread):
    def __init__(self, pcapObj):
        # Query the type of the link and instantiate a decoder accordingly.
        datalink = pcapObj.datalink()
        if pcapy.DLT_EN10MB == datalink:
            self.decoder = EthDecoder()
        elif pcapy.DLT_LINUX_SLL == datalink:
            self.decoder = LinuxSLLDecoder()
        else:
            raise Exception("Datalink type not supported: " % datalink)

        self.pcap = pcapObj
        Thread.__init__(self)

    def run(self):
        # Sniff ad infinitum.
        # PacketHandler shall be invoked by pcap for every packet.
        self.pcap.loop(0, self.packetHandler)

    def packetHandler(self, hdr, data):
        # Use the ImpactDecoder to turn the rawpacket into a hierarchy
        # of ImpactPacket instances.
        # Display the packet in human-readable form.
        print self.decoder.decode(data)

class DecoderThread(Thread):
    def __init__(self, pcapObj,subnet,arptable):
        # Query the type of the link and instantiate a decoder accordingly.
        datalink = pcapObj.datalink()
        if pcapy.DLT_EN10MB == datalink:
            self.decoder = EthDecoder()
        elif pcapy.DLT_LINUX_SLL == datalink:
            self.decoder = LinuxSLLDecoder()
        else:
            raise Exception("Datalink type not supported: " % datalink)

        self.pcap = pcapObj
        self.subnet = subnet
        self.arptable = arptable
        Thread.__init__(self)
        #super(Thread, self).__init__()

    def run(self):
        # Sniff ad infinitum.
        # PacketHandler shall be invoked by pcap for every packet.
        self.pcap.loop(0, self.packetHandler)


    def packetHandler(self, hdr, data):
        e = self.decoder.decode(data)
        if e.get_ether_type() == impacket.ImpactPacket.IP.ethertype:
          #print e.child().get_ip_src()
          ip = e.child()
          ttl = ip.get_ip_ttl()
          ## Uneven but not 1 or 255 ttl means it's probably coming from a router ##
          if (ttl % 2) > 0 and ttl > 1 and ttl != 255:
              self.subnet.gatewaymac = e.get_ether_shost()
              self.subnet.sourcemac = e.get_ether_dhost()
              self.subnet.sourceaddress = ip.get_ip_dst()

        if e.get_ether_type() == impacket.ImpactPacket.ARP.ethertype:
          arp = e.child()
          self.subnet.registeraddress(arp.get_ar_tpa())
          self.subnet.registeraddress(arp.get_ar_spa())
          
          if arp.get_op_name(arp.get_ar_op()) == "REPLY":
              print "got arp reply"
              self.arptable.registeraddress(arp.get_ar_spa(), arp.as_hrd(arp.get_ar_sha()))
	  if arp.get_op_name(arp.get_ar_op()) == "REQUEST":
              self.arptable.registeraddress(arp.get_ar_spa(), arp.as_hrd(arp.get_ar_sha()))

    def __init__(self, promisc=True, buffer_size=None, read_timeout=100, show_packets=False):
        self._pcap_t = None
        self._packets = None

        assert promisc in (True, False), "promisc must be either True or False"
        self._promisc = promisc

        self._buffer_size = buffer_size
        self._read_timeout = read_timeout

        assert show_packets in (True, False), "show_packets must be either True or False"
        self._show_packets = show_packets

        self._pcap_lock = threading.Lock()

        try:
            from impacket.ImpactDecoder import LinuxSLLDecoder
            self._decoder = LinuxSLLDecoder()
        except ImportError:
            self._decoder = None

class NetdudeDecoder(Decoder):
    """
    """
    
    def __init__(self,pcapObj ):
        """
        """
        self.proto_id = None
        self.src_ip = None
        self.tgt_ip = None
        self.src_port = None
        self.tgt_port = None
        self.msgs = [] # error msgs
        datalink = pcapObj.datalink()
        if pcapy.DLT_EN10MB == datalink:
            self.decoder = EthDecoder()
        elif pcapy.DLT_LINUX_SLL == datalink:
            self.decoder = LinuxSLLDecoder()
        else:
            raise Exception("Datalink type not supported: " % datalink)

        self.pcap = pcapObj
        self.connections = []
        
    def packetHandler(self, hdr, data):
        try:
            p = self.decoder.decode(data)
            logging.debug("start decoding" )
        except Exception, e:
            logging.error("p = self.decoder.decode(data) failed for device" )
            msgs.append(str(e))
        # get the details from the decoded packet data
        if p:
            try:
                self.src_ip  = p.child().get_ip_src()
                self.tgt_ip = p.child().get_ip_dst()
                self.proto_id = p.child().child().protocol
            except Exception, e:
                logging.error("exception while parsing ip packet: %s" % str(e))
                self.msgs.append(str(e))