Package modules :: Package processing :: Module network
[hide private]
[frames] | no frames]

Module network

source code

Classes [hide private]
  Keyed
Keyed(key, obj)
  Packet
Packet(raw, ts)
  Pcap
Reads network data from PCAP file.
  NetworkAnalysis
Network analysis.
  SortCap
SortCap is a wrapper around the packet lib (dpkt) that allows us to sort pcaps together with the batch_sort function above.
Functions [hide private]
 
iplayer_from_raw(raw, linktype=1)
Converts a raw packet to a dpkt packet regarding of link type.
source code
 
conn_from_flowtuple(ft)
Convert the flow tuple into a dictionary (suitable for JSON)
source code
 
batch_sort(input_iterator, output_path, buffer_size=32000, output_class=None)
batch sort helper with temporary files, supports sorting large stuff
source code
 
sort_pcap(inpath, outpath)
Use SortCap class together with batch_sort to sort a pcap
source code
 
flowtuple_from_raw(raw, linktype=1)
Parse a packet from a pcap just enough to gain a flow description tuple
source code
 
payload_from_raw(raw, linktype=1)
Get the payload from a packet, the data below TCP/UDP basically
source code
 
next_connection_packets(piter, linktype=1)
Extract all packets belonging to the same flow from a pcap packet iterator
source code
 
packets_for_stream(fobj, offset)
Open a PCAP, seek to a packet offset, then get all packets belonging to the same connection
source code
Variables [hide private]
  IS_DPKT = True
  TMPD = '/tmp'
  __package__ = 'modules.processing'
Function Details [hide private]

iplayer_from_raw(raw, linktype=1)

source code 

Converts a raw packet to a dpkt packet regarding of link type.

Parameters:
  • raw - raw packet
  • linktype - integer describing link type as expected by dpkt