Somanath Nayak
Somanath Nayak

Reputation: 11

Wireshark conversation completeness

I have a pcap file. I need to retrieve a particular parameter from it: its call conversation completeness flag - how packets went to and fro. I need to be able to retrieve that using python.

I am using scapy to do most of the extraction for other parameters. This is the code; nothing wrong with it but I don't understand how I am supposed to retrieve the aforementioned.

from scapy.all import *

def analyze_tcp_pcap(pcap_file):
    try:
        packets = rdpcap(pcap_file)
        count=0
        mal=0

        for packet in packets:
            if 'TCP' in packet:
                count+=1
                # print(count)
                flags = packet['TCP'].flags
                FIN=0
                SYN=0
                RST=0
                ACK=0
                SYN_ACK=0

                if flags & 0x01:  # Check if FIN flag is set
                    FIN=1
                    # print("FIN:",FIN)
                if flags & 0x02:  # Check if SYN flag is set
                    SYN=1
                    # print("SYN:",SYN)
                if flags & 0x04:  # Check if RST flag is set
                    RST=1
                    # print("RST:",RST)
                if flags & 0x10:  # Check if ACK flag is set
                    ACK=1
                    # print("ACK:",ACK)
                if SYN and ACK:
                    SYN_ACK=SYN and ACK
                    # print("SYN-ACK:",SYN_ACK)

                mss_option = [opt[1] for opt in packet['TCP'].options if opt[0] == 'MSS']
                if mss_option:
                    mss_value = mss_option[0]
                    # print("Maximum Segment Size (MSS):", mss_value)


                header_length = packet['TCP'].dataofs * 4  # Convert to bytes
                # print("TCP Header Length:",header_length)

                window_size=packet['TCP'].window
                # print("Window Size:",window_size)

                data_length=len(packet['TCP'].payload) #in bytes
                # print("Data Length:",data_length)

                packet_length=len(packet)
                # print("Packet Length:",packet_length)
                # print()

                
                if window_size==1825 and RST==0 and FIN==ACK==SYN_ACK==SYN==1 and packet_length==66 and mss_value==1460 and header_length==32:
                    mal=1
                    print(count)
                    break

        if mal==1:
            print("A portscan has been attempted on your system!!!")
        else:
            print("Perfectly Normal Network Activity, Happy Networking!!")


    except Exception as e:
        print(f"An error occurred: {str(e)}")


pcap_file_path = r"C:\Users"
analyze_tcp_pcap(pcap_file_path)

I have tried using other third party modules (pyshark) but it seems like none of them give a proper return output for the complete conversation effectiveness. I need to filter them out using code, not graphically through Wireshark interface.

Upvotes: 1

Views: 644

Answers (0)

Related Questions