Reputation: 11
I have a pcap file. I need to retrieve a particular parameter from it: its call conversation completeness flag - how packets went to and fro. I need to be able to retrieve that using python.
I am using scapy to do most of the extraction for other parameters. This is the code; nothing wrong with it but I don't understand how I am supposed to retrieve the aforementioned.
from scapy.all import *
def analyze_tcp_pcap(pcap_file):
try:
packets = rdpcap(pcap_file)
count=0
mal=0
for packet in packets:
if 'TCP' in packet:
count+=1
# print(count)
flags = packet['TCP'].flags
FIN=0
SYN=0
RST=0
ACK=0
SYN_ACK=0
if flags & 0x01: # Check if FIN flag is set
FIN=1
# print("FIN:",FIN)
if flags & 0x02: # Check if SYN flag is set
SYN=1
# print("SYN:",SYN)
if flags & 0x04: # Check if RST flag is set
RST=1
# print("RST:",RST)
if flags & 0x10: # Check if ACK flag is set
ACK=1
# print("ACK:",ACK)
if SYN and ACK:
SYN_ACK=SYN and ACK
# print("SYN-ACK:",SYN_ACK)
mss_option = [opt[1] for opt in packet['TCP'].options if opt[0] == 'MSS']
if mss_option:
mss_value = mss_option[0]
# print("Maximum Segment Size (MSS):", mss_value)
header_length = packet['TCP'].dataofs * 4 # Convert to bytes
# print("TCP Header Length:",header_length)
window_size=packet['TCP'].window
# print("Window Size:",window_size)
data_length=len(packet['TCP'].payload) #in bytes
# print("Data Length:",data_length)
packet_length=len(packet)
# print("Packet Length:",packet_length)
# print()
if window_size==1825 and RST==0 and FIN==ACK==SYN_ACK==SYN==1 and packet_length==66 and mss_value==1460 and header_length==32:
mal=1
print(count)
break
if mal==1:
print("A portscan has been attempted on your system!!!")
else:
print("Perfectly Normal Network Activity, Happy Networking!!")
except Exception as e:
print(f"An error occurred: {str(e)}")
pcap_file_path = r"C:\Users"
analyze_tcp_pcap(pcap_file_path)
I have tried using other third party modules (pyshark) but it seems like none of them give a proper return output for the complete conversation effectiveness. I need to filter them out using code, not graphically through Wireshark interface.
Upvotes: 1
Views: 644