modules.processing.network

Package modules :: Package processing :: Module network |
[hide private]
[frames] | no frames]

# Module network

source code

Classes | [hide private]
| Pcap Reads network data from PCAP file.
| Pcap2 Interprets the PCAP file through the httpreplay library which parses the various protocols, decrypts and decodes them, and then provides us with the high level representation of it.
| NetworkAnalysis Network analysis.
| SortCap SortCap is a wrapper around the packet lib (dpkt) that allows us to sort pcaps together with the batch_sort function above.

Functions | [hide private]
iplayer_from_raw(raw, linktype=1) Converts a raw packet to a dpkt packet regarding of link type. | source code
conn_from_flowtuple(ft) Convert the flow tuple into a dictionary (suitable for JSON) | source code
batch_sort(input_iterator, output_path, buffer_size=32000, output_class=None) batch sort helper with temporary files, supports sorting large stuff | source code
sort_pcap(inpath, outpath) Use SortCap class together with batch_sort to sort a pcap | source code
flowtuple_from_raw(raw, linktype=1) Parse a packet from a pcap just enough to gain a flow description tuple | source code
payload_from_raw(raw, linktype=1) Get the payload from a packet, the data below TCP/UDP basically | source code
next_connection_packets(piter, linktype=1) Extract all packets belonging to the same flow from a pcap packet iterator. | source code
packets_for_stream(fobj, offset) Open a PCAP, seek to a packet offset, then get all packets belonging to the same connection. | source code

Variables | [hide private]
| HAVE_DPKT = `False`
| HAVE_HTTPREPLAY = `False`
| Keyed = `namedtuple("Keyed", ["key", "obj"])`
| Packet = `namedtuple("Packet", ["raw", "ts"])`
| log = `logging.getLogger(__name__)`
| cfg = `Config()`
| _v = `getattr(httpreplay, "__version__", None) if HAVE_HTTPREPL`...``

Function Details | [hide private]

### iplayer_from_raw(raw, linktype=1) | source code
Converts a raw packet to a dpkt packet regarding of link type. Parameters: `raw` - raw packet `linktype` - integer describing link type as expected by dpkt

Variables Details | [hide private]

  ### _v Value:
      getattr(httpreplay, "__version__", None) if HAVE_HTTPREPLAY else None