FlowAnalyzer 0.3.1__py3-none-any.whl → 0.3.3__py3-none-any.whl

FlowAnalyzer/FlowAnalyzer.py

@@ -15,19 +15,19 @@ logger = configure_logger("FlowAnalyzer", logging.INFO)
 
 
 class Request(NamedTuple):
-    frame_num: Optional[int]
+    frame_num: int
     header: bytes
     file_data: bytes
-    full_uri: Optional[str]
-    time_epoch: Optional[float]
+    full_uri: str
+    time_epoch: float
 
 
 class Response(NamedTuple):
-    frame_num: Optional[int]
+    frame_num: int
     header: bytes
     file_data: bytes
-    request_in: Optional[int]
-    time_epoch: Optional[float]
+    request_in: int
+    time_epoch: float
 
 
 class HttpPair(NamedTuple):
@@ -66,6 +66,37 @@ class FlowAnalyzer:
         if os.path.getsize(self.jsonPath) == 0:
             raise ValueError("您的tshark导出的JSON文件内容为空！JSON路径：%s" % self.jsonPath)
 
+    def parse_packet(self, packet: dict) -> Tuple[int, int, float, str, str]:
+        """解析Json中的关键信息字段
+
+        Parameters
+        ----------
+        packet : dict
+            传入Json字典
+
+        Returns
+        -------
+        Tuple[int, int, float, str, str]
+            frame_num, request_in, time_epoch, full_uri, full_request
+        """
+        # frame_num = int(packet["frame.number"][0]) if packet.get("frame.number") else None
+        # time_epoch = float(packet["frame.time_epoch"][0]) if packet.get("frame.time_epoch") else None
+        # full_uri = parse.unquote(packet["http.request.full_uri"][0]) if packet.get("http.request.full_uri") else None
+        
+        frame_num = int(packet["frame.number"][0])
+        request_in = int(packet["http.request_in"][0]) if packet.get("http.request_in") else frame_num
+        full_uri = parse.unquote(packet["http.request.full_uri"][0]) if packet.get("http.request.full_uri") else ""
+        time_epoch = float(packet["frame.time_epoch"][0])
+
+        if packet.get("tcp.reassembled.data"):
+            full_request = packet["tcp.reassembled.data"][0]
+        elif packet.get("tcp.payload"):
+            full_request = packet["tcp.payload"][0]
+        else:
+            # exported_pdu.exported_pdu
+            full_request = packet["exported_pdu.exported_pdu"][0]
+        return frame_num, request_in, time_epoch, full_uri, full_request
+
     def parse_http_json(self) -> Tuple[Dict[int, Request], Dict[int, Response]]:
         # sourcery skip: use-named-expression
         """解析JSON数据文件中的HTTP请求和响应信息
@@ -81,22 +112,10 @@ class FlowAnalyzer:
         requests, responses = {}, {}
         for packet in data:
             packet = packet["_source"]["layers"]
-            time_epoch = float(packet["frame.time_epoch"][0]) if packet.get("frame.time_epoch") else None
-
-            if packet.get("tcp.reassembled.data"):
-                full_request = packet["tcp.reassembled.data"][0]
-            elif packet.get("tcp.payload"):
-                full_request = packet["tcp.payload"][0]
-            else:
-                # exported_pdu.exported_pdu
-                full_request = packet["exported_pdu.exported_pdu"][0]
-
-            frame_num = int(packet["frame.number"][0]) if packet.get("frame.number") else None
-            request_in = int(packet["http.request_in"][0]) if packet.get("http.request_in") else frame_num
-            full_uri = parse.unquote(packet["http.request.full_uri"][0]) if packet.get("http.request.full_uri") else None
-
+            frame_num, request_in, time_epoch, full_uri, full_request = self.parse_packet(packet)
             header, file_data = self.extract_http_file_data(full_request)
 
+            # 请求包使用 full_uri 来记录请求 url  返回包使用 request_in 来记录请求包的序号
             if packet.get("http.response_number"):
                 responses[frame_num] = Response(
                     frame_num=frame_num,
@@ -146,32 +165,15 @@ class FlowAnalyzer:
         # tshark -r {} -Y "{}" -T json -e http.request_number -e http.response_number -e http.request_in -e tcp.reassembled.data -e frame.number -e tcp.payload -e frame.time_epoch -e http.request.full_uri > output.json
 
         command = [
-            "tshark",
-            "-r",
-            fileName,
-            "-Y",
-            f"(tcp.reassembled_in) or ({display_filter})",
-            "-T",
-            "json",
-            "-e",
-            "http.request_number",
-            "-e",
-            "http.response_number",
-            "-e",
-            "http.request_in",
-            "-e",
-            "tcp.reassembled.data",
-            "-e",
-            "frame.number",
-            "-e",
-            "tcp.payload",
-            "-e",
-            "frame.time_epoch",
-            "-e",
-            "exported_pdu.exported_pdu",
-            "-e",
-            "http.request.full_uri" ">",
-            "output.json",
+            "tshark", "-r", fileName,
+            "-Y", f"(tcp.reassembled_in) or ({display_filter})",
+            "-T", "json",
+            "-e", "http.request_number", "-e", "http.response_number", "-e", "http.request_in",
+            "-e", "tcp.reassembled.data", "-e", "frame.number", "-e", "tcp.payload",
+            "-e", "frame.time_epoch",
+            "-e", "exported_pdu.exported_pdu",
+            "-e", "http.request.full_uri",
+            ">", "output.json",
         ]
 
         _, stderr = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, cwd=tshark_workDir).communicate()

{FlowAnalyzer-0.3.1.dist-info → FlowAnalyzer-0.3.3.dist-info}/METADATA

@@ -1,12 +1,10 @@
 Metadata-Version: 2.1
 Name: FlowAnalyzer
-Version: 0.3.1
+Version: 0.3.3
 Summary: FlowAnalyzer是一个流量分析器，用于解析和处理tshark导出的JSON数据文件
 Home-page: https://github.com/Byxs20/FlowAnalyzer
 Author: Byxs20
 Author-email: 97766819@qq.com
-License: UNKNOWN
-Platform: UNKNOWN
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
@@ -16,6 +14,7 @@ Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Description-Content-Type: text/markdown
+License-File: LICENSE
 
 # FlowAnalyzer
 
@@ -53,7 +52,7 @@ display_filter = "(http.request and urlencoded-form) or (http.request and data-t
 jsonPath = FlowAnalyzer.get_json_data(flowPath, display_filter=display_filter)
 for count, http in enumerate(FlowAnalyzer(jsonPath).generate_http_dict_pairs(), start=1):
     print(f"[+] 正在处理第{count}个HTTP流!")
-
+    
     request, response = http.request, http.response
     if request:
         request_num, header, file_data, time_epoch = request.frame_num, request.header, request.file_data, request.time_epoch
@@ -83,5 +82,3 @@ Feel free to submit issues or pull requests if you have any suggestions, improve
 # License
 
 This project is licensed under the [MIT License.](LICENSE)
-
-

FlowAnalyzer-0.3.3.dist-info/RECORD

@@ -0,0 +1,8 @@
+FlowAnalyzer/FlowAnalyzer.py,sha256=LpTPzcikRpeTOfNumMM8Kd08Jh8nQkC6jOx27EsD-yk,11285
+FlowAnalyzer/__init__.py,sha256=vfiHONPTrvjUU3MwhjFOEo3sWfzlhkA6gOLn_4UJ7sg,70
+FlowAnalyzer/logging_config.py,sha256=e-73IByM1TuE2G1isOBvtIcr9XztWqPkGN-VsNEFbvY,671
+FlowAnalyzer-0.3.3.dist-info/LICENSE,sha256=ybAV0ECduYBZCpjkHyNALVWRRmT_eM0BDgqUszhwEFU,1080
+FlowAnalyzer-0.3.3.dist-info/METADATA,sha256=9HR-TIXj1i7kLgpfpQ7blxf55pOoOp-n5_je_nNb_vk,10288
+FlowAnalyzer-0.3.3.dist-info/WHEEL,sha256=R0nc6qTxuoLk7ShA2_Y-UWkN8ZdfDBG2B6Eqpz2WXbs,91
+FlowAnalyzer-0.3.3.dist-info/top_level.txt,sha256=2MtvAF6dEe_eHipw_6G5pFLb2uOCbGnlH0bC4iBtm5A,13
+FlowAnalyzer-0.3.3.dist-info/RECORD,,

{FlowAnalyzer-0.3.1.dist-info → FlowAnalyzer-0.3.3.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: bdist_wheel (0.40.0)
+Generator: setuptools (72.1.0)
 Root-Is-Purelib: true
 Tag: py3-none-any
 

FlowAnalyzer-0.3.1.dist-info/RECORD

@@ -1,8 +0,0 @@
-FlowAnalyzer/FlowAnalyzer.py,sha256=aTrTmIbajG8EqiyDnVTFnuhvL32uIHNzgtHzMs8Bs_U,10695
-FlowAnalyzer/__init__.py,sha256=vfiHONPTrvjUU3MwhjFOEo3sWfzlhkA6gOLn_4UJ7sg,70
-FlowAnalyzer/logging_config.py,sha256=e-73IByM1TuE2G1isOBvtIcr9XztWqPkGN-VsNEFbvY,671
-FlowAnalyzer-0.3.1.dist-info/LICENSE,sha256=ybAV0ECduYBZCpjkHyNALVWRRmT_eM0BDgqUszhwEFU,1080
-FlowAnalyzer-0.3.1.dist-info/METADATA,sha256=wR3Rq7muUriFb3zb5lqgJ7f63ns_RYRfVvn_NzPtATY,10302
-FlowAnalyzer-0.3.1.dist-info/WHEEL,sha256=pkctZYzUS4AYVn6dJ-7367OJZivF2e8RA9b_ZBjif18,92
-FlowAnalyzer-0.3.1.dist-info/top_level.txt,sha256=2MtvAF6dEe_eHipw_6G5pFLb2uOCbGnlH0bC4iBtm5A,13
-FlowAnalyzer-0.3.1.dist-info/RECORD,,