FlowAnalyzer 0.2.8__tar.gz → 0.3.1__tar.gz

{FlowAnalyzer-0.2.8 → FlowAnalyzer-0.3.1}/FlowAnalyzer/FlowAnalyzer.py

@@ -13,6 +13,7 @@ from .logging_config import configure_logger
 
 logger = configure_logger("FlowAnalyzer", logging.INFO)
 
+
 class Request(NamedTuple):
     frame_num: Optional[int]
     header: bytes
@@ -81,14 +82,18 @@ class FlowAnalyzer:
         for packet in data:
             packet = packet["_source"]["layers"]
             time_epoch = float(packet["frame.time_epoch"][0]) if packet.get("frame.time_epoch") else None
-            full_request = (
-                packet["tcp.reassembled.data"][0] if packet.get("tcp.reassembled.data") else packet["tcp.payload"][0]
-            )
+
+            if packet.get("tcp.reassembled.data"):
+                full_request = packet["tcp.reassembled.data"][0]
+            elif packet.get("tcp.payload"):
+                full_request = packet["tcp.payload"][0]
+            else:
+                # exported_pdu.exported_pdu
+                full_request = packet["exported_pdu.exported_pdu"][0]
+
             frame_num = int(packet["frame.number"][0]) if packet.get("frame.number") else None
             request_in = int(packet["http.request_in"][0]) if packet.get("http.request_in") else frame_num
-            full_uri = (
-                parse.unquote(packet["http.request.full_uri"][0]) if packet.get("http.request.full_uri") else None
-            )
+            full_uri = parse.unquote(packet["http.request.full_uri"][0]) if packet.get("http.request.full_uri") else None
 
             header, file_data = self.extract_http_file_data(full_request)
 
@@ -139,23 +144,52 @@ class FlowAnalyzer:
     def extract_json_file(fileName: str, display_filter: str, tshark_workDir: str) -> None:
         # sourcery skip: replace-interpolation-with-fstring, use-fstring-for-formatting
         # tshark -r {} -Y "{}" -T json -e http.request_number -e http.response_number -e http.request_in -e tcp.reassembled.data -e frame.number -e tcp.payload -e frame.time_epoch -e http.request.full_uri > output.json
-        command = (
-            'tshark -r {} -Y "{}" -T json '
-            '-e http.request_number '
-            '-e http.response_number '
-            '-e http.request_in '
-            '-e tcp.reassembled.data '
-            '-e frame.number '
-            '-e tcp.payload '
-            '-e frame.time_epoch '
-            '-e http.request.full_uri '
-            '> output.json'.format(
-                fileName, display_filter
-        ))
+
+        command = [
+            "tshark",
+            "-r",
+            fileName,
+            "-Y",
+            f"(tcp.reassembled_in) or ({display_filter})",
+            "-T",
+            "json",
+            "-e",
+            "http.request_number",
+            "-e",
+            "http.response_number",
+            "-e",
+            "http.request_in",
+            "-e",
+            "tcp.reassembled.data",
+            "-e",
+            "frame.number",
+            "-e",
+            "tcp.payload",
+            "-e",
+            "frame.time_epoch",
+            "-e",
+            "exported_pdu.exported_pdu",
+            "-e",
+            "http.request.full_uri" ">",
+            "output.json",
+        ]
+
         _, stderr = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, cwd=tshark_workDir).communicate()
         if stderr != b"" and b"WARNING" not in stderr:
             print(f"[Waring/Error]: {stderr}")
 
+    @staticmethod
+    def move_and_addMD5Sum(tshark_jsonPath: str, jsonWordPath: str, MD5Sum: str) -> None:
+        if tshark_jsonPath != jsonWordPath:
+            shutil.move(tshark_jsonPath, jsonWordPath)
+
+        with open(jsonWordPath, "r", encoding="utf-8") as f:
+            data = json.load(f)
+        data[0]["MD5Sum"] = MD5Sum
+
+        with open(jsonWordPath, "w", encoding="utf-8") as f:
+            json.dump(data, f, indent=2)
+
     @staticmethod
     def get_json_data(filePath: str, display_filter: str) -> str:
         # sourcery skip: replace-interpolation-with-fstring
@@ -186,20 +220,12 @@ class FlowAnalyzer:
         if os.path.exists(jsonWordPath):
             with open(jsonWordPath, "r", encoding="utf-8") as f:
                 data = json.load(f)
-            if data[0].get('MD5Sum') == MD5Sum:
+            if data[0].get("MD5Sum") == MD5Sum:
                 logger.debug("匹配HASH校验无误，自动返回Json文件路径!")
                 return jsonWordPath
-        FlowAnalyzer.extract_json_file(fileName, display_filter, tshark_workDir)
 
-        if tshark_jsonPath != jsonWordPath:
-            shutil.move(tshark_jsonPath, jsonWordPath)
-        
-        with open(jsonWordPath, "r", encoding="utf-8") as f:
-            data = json.load(f)
-        data[0]['MD5Sum'] = MD5Sum
-        
-        with open(jsonWordPath, "w", encoding="utf-8") as f:
-            json.dump(data, f, indent=2)
+        FlowAnalyzer.extract_json_file(fileName, display_filter, tshark_workDir)
+        FlowAnalyzer.move_and_addMD5Sum(tshark_jsonPath, jsonWordPath, MD5Sum)
         return jsonWordPath
 
     def Split_HTTP_headers(self, file_data: bytes) -> Tuple[bytes, bytes]:

{FlowAnalyzer-0.2.8 → FlowAnalyzer-0.3.1}/FlowAnalyzer.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: FlowAnalyzer
-Version: 0.2.8
+Version: 0.3.1
 Summary: FlowAnalyzer是一个流量分析器，用于解析和处理tshark导出的JSON数据文件
 Home-page: https://github.com/Byxs20/FlowAnalyzer
 Author: Byxs20
@@ -22,6 +22,8 @@ Description: # FlowAnalyzer
         
         # Usage
         
+        请务必添加 `tshark.exe` 到环境变量，否则找不到会出错！
+        
         ```
         $ git clone https://github.com/Byxs20/FlowAnalyzer.git
         $ cd ./FlowAnalyzer/

{FlowAnalyzer-0.2.8 → FlowAnalyzer-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: FlowAnalyzer
-Version: 0.2.8
+Version: 0.3.1
 Summary: FlowAnalyzer是一个流量分析器，用于解析和处理tshark导出的JSON数据文件
 Home-page: https://github.com/Byxs20/FlowAnalyzer
 Author: Byxs20
@@ -22,6 +22,8 @@ Description: # FlowAnalyzer
         
         # Usage
         
+        请务必添加 `tshark.exe` 到环境变量，否则找不到会出错！
+        
         ```
         $ git clone https://github.com/Byxs20/FlowAnalyzer.git
         $ cd ./FlowAnalyzer/

{FlowAnalyzer-0.2.8 → FlowAnalyzer-0.3.1}/README.md

@@ -14,6 +14,8 @@ pip3 install FlowAnalyzer -i https://pypi.org/simple
 
 # Usage
 
+请务必添加 `tshark.exe` 到环境变量，否则找不到会出错！
+
 ```
 $ git clone https://github.com/Byxs20/FlowAnalyzer.git
 $ cd ./FlowAnalyzer/

{FlowAnalyzer-0.2.8 → FlowAnalyzer-0.3.1}/setup.py

@@ -7,7 +7,7 @@ with open(os.path.join(os.path.dirname(__file__), "README.md"), encoding="utf-8"
 
 setup(
     name="FlowAnalyzer",
-    version="0.2.8",
+    version="0.3.1",
     description="FlowAnalyzer是一个流量分析器，用于解析和处理tshark导出的JSON数据文件",
     author="Byxs20",
     author_email="97766819@qq.com",