network-core 0.2.2__tar.gz → 0.3.0__tar.gz

{network_core-0.2.2 → network_core-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: network_core
-Version: 0.2.2
+Version: 0.3.0
 Summary: Core networking utilities and data models
 Author: Your Name
 Requires-Python: >=3.9
@@ -13,3 +13,4 @@ Requires-Dist: scapy
 Requires-Dist: matplotlib
 Requires-Dist: brotli
 Requires-Dist: blackboxprotobuf
+Requires-Dist: cryptography

network_core-0.3.0/network_core/__init__.py

@@ -0,0 +1,17 @@
+from .conn import Connection
+from .connOps import (
+    ConnStats,
+    filterConnections,
+    combine_connections,
+    printConns,
+    getPacketsInInterval,
+    normalizePacketStream,
+)
+from .dataModels import PacketType, TransPortType, FiveTuple, PacketInfo, HttpUnit
+from .analysis import (
+    classify_http_version,
+    http_version_debug,
+    detect_requests,
+    conn_features,
+    nan_to_none,
+)

network_core-0.3.0/network_core/analysis.py

@@ -0,0 +1,248 @@
+"""Connection and packet stream analysis functions."""
+from __future__ import annotations
+
+import math
+
+import numpy as np
+
+from .dataModels import PacketInfo
+
+
+def classify_http_version(ps: list[PacketInfo], alpn: str = "nan") -> str:
+    """Infer HTTP version, preferring ALPN ground truth over a packet heuristic.
+
+    If ALPN is available (not 'nan'), it is authoritative:
+      'h2'       → 'HTTP/2'
+      'http/1.1' → 'HTTP/1.1'
+    Fallback heuristic (used when ALPN is 'nan', i.e. session-reused socket):
+      Median of small (<200 B) upload packets ≤ 72 B → HTTP/1.1  (pure TCP ACKs)
+      Median > 72 B → HTTP/2  (WINDOW_UPDATE/PING frames ~79-87 B)
+    Returns 'HTTP/1.1', 'HTTP/2', or 'unknown'.
+    """
+    if alpn and alpn not in ("nan", ""):
+        if alpn == "h2":
+            return "HTTP/2"
+        if alpn in ("http/1.1", "http/1.0"):
+            return "HTTP/1.1"
+    small = np.array(
+        [p.length for p in ps if p.direction == 0 and p.length < 200],
+        dtype=np.float32,
+    )
+    if len(small) < 3:
+        return "unknown"
+    return "HTTP/1.1" if np.median(small) <= 72 else "HTTP/2"
+
+
+def http_version_debug(ps: list[PacketInfo], alpn: str = "nan") -> dict:
+    """Return a detailed breakdown of the HTTP version classification.
+
+    Useful for auditing flows where the heuristic result seems wrong.
+    """
+    small = [p.length for p in ps if p.direction == 0 and p.length < 200]
+    all_up = [p.length for p in ps if p.direction == 0]
+
+    verdict = classify_http_version(ps, alpn)
+    source = "ALPN" if (alpn and alpn not in ("nan", "")) else "heuristic"
+
+    buckets = {
+        "<54":     sum(1 for l in small if l < 54),
+        "54-66":   sum(1 for l in small if 54 <= l <= 66),
+        "67-80":   sum(1 for l in small if 67 <= l <= 80),
+        "81-100":  sum(1 for l in small if 81 <= l <= 100),
+        "101-199": sum(1 for l in small if 101 <= l <= 199),
+    }
+
+    med = float(np.median(small)) if small else None
+    if source == "ALPN":
+        confidence = "high (ALPN)"
+    elif med is None:
+        confidence = "unknown (no small packets)"
+    elif abs(med - 72) > 12:
+        confidence = "high (heuristic)"
+    else:
+        confidence = "low (heuristic, median near threshold)"
+
+    return {
+        "verdict": verdict,
+        "source": source,
+        "confidence": confidence,
+        "alpn": alpn,
+        "small_up_count": len(small),
+        "total_up_count": len(all_up),
+        "small_up_median": med,
+        "small_up_p25": float(np.percentile(small, 25)) if small else None,
+        "small_up_p75": float(np.percentile(small, 75)) if small else None,
+        "small_up_min": float(min(small)) if small else None,
+        "small_up_max": float(max(small)) if small else None,
+        "histogram": buckets,
+        "threshold": 72,
+        "note": "ACKs cluster at ~66 B; HTTP/2 WINDOW_UPDATE/PING at ~79-87 B",
+    }
+
+
+def detect_requests(
+    ps: list[PacketInfo],
+    gap_ms: float = 800,
+    min_bytes: int = 5000,
+    min_pkts: int = 5,
+) -> list[dict]:
+    """Split the upload stream on idle gaps to find HTTP/1.1 request boundaries.
+
+    Only data-carrying packets (>100 B) are used for burst detection to avoid
+    pure TCP ACKs extending burst windows across server-sent heartbeats.
+
+    Returns one dict per detected request:
+      req_kb, req_pkts, req_dur_ms — upload burst stats
+      think_ms                     — server processing time (first dn packet after burst)
+      res_kb, res_pkts, res_dur_ms — downstream response stats
+      client_gap_ms                — gap before next request (None if last)
+      t_start, t_end               — burst timestamps
+      turn_idx                     — 0-based request index
+    """
+    data_ups = [p for p in ps if p.direction == 0 and p.length > 100]
+    if len(data_ups) < 2:
+        return []
+
+    bursts: list[list[PacketInfo]] = []
+    cur = [data_ups[0]]
+    for i in range(1, len(data_ups)):
+        if (data_ups[i].timestamp - data_ups[i - 1].timestamp) * 1000 > gap_ms:
+            bursts.append(cur)
+            cur = [data_ups[i]]
+        else:
+            cur.append(data_ups[i])
+    bursts.append(cur)
+
+    real = [
+        b for b in bursts
+        if sum(p.length for p in b) >= min_bytes and len(b) >= min_pkts
+    ]
+    if not real:
+        return []
+
+    dns = [p for p in ps if p.direction == 1]
+    dn_ts = np.array([p.timestamp for p in dns], dtype=np.float64)
+    dn_lens = np.array([p.length for p in dns], dtype=np.float32)
+    last_ts = ps[-1].timestamp
+
+    rows = []
+    for idx, b in enumerate(real):
+        burst_end = b[-1].timestamp
+        next_start = real[idx + 1][0].timestamp if idx + 1 < len(real) else None
+        res_win_end = next_start if next_start else last_ts + 1
+
+        dn_s = int(np.searchsorted(dn_ts, burst_end, side="right"))
+        dn_e = int(np.searchsorted(dn_ts, res_win_end, side="left"))
+
+        think_ms = float((dn_ts[dn_s] - burst_end) * 1000) if dn_s < len(dn_ts) else None
+        res_lens = dn_lens[dn_s:dn_e]
+        res_kb = float(res_lens.sum()) / 1024
+        n_res = dn_e - dn_s
+
+        if n_res > 0:
+            res_dur_ms = float((dn_ts[dn_e - 1] - dn_ts[dn_s]) * 1000)
+            client_gap_ms = float((next_start - dn_ts[dn_e - 1]) * 1000) if next_start else None
+        else:
+            res_dur_ms = client_gap_ms = None
+
+        rows.append({
+            "req_kb":        sum(p.length for p in b) / 1024,
+            "req_pkts":      len(b),
+            "req_dur_ms":    (b[-1].timestamp - b[0].timestamp) * 1000,
+            "think_ms":      think_ms,
+            "res_kb":        res_kb,
+            "res_pkts":      n_res,
+            "res_dur_ms":    res_dur_ms,
+            "client_gap_ms": client_gap_ms,
+            "t_start":       b[0].timestamp,
+            "t_end":         burst_end,
+            "turn_idx":      idx,
+        })
+    return rows
+
+
+def conn_features(
+    ps: list[PacketInfo],
+    http_ver: str,
+    requests: list[dict],
+) -> dict | None:
+    """Extract connection-level features for ML or analysis.
+
+    Returns None if the connection has too few packets to be meaningful.
+    NaN fields indicate metrics that require ≥2 requests (e.g. req_slope).
+    """
+    if len(ps) < 5:
+        return None
+
+    lens = np.array([p.length    for p in ps], dtype=np.float32)
+    dirs = np.array([p.direction for p in ps], dtype=np.int8)
+    ts   = np.array([p.timestamp for p in ps], dtype=np.float64)
+    iats = np.diff(ts) * 1000
+
+    up_m     = dirs == 0
+    bytes_up = float(lens[up_m].sum())
+    bytes_dn = float(lens[~up_m].sum())
+    total    = bytes_up + bytes_dn
+    if total == 0 or len(iats) == 0:
+        return None
+
+    req_kbs = [r["req_kb"] for r in requests]
+    res_kbs = [r["res_kb"] for r in requests]
+
+    if len(req_kbs) >= 2:
+        turns      = np.arange(len(req_kbs), dtype=float)
+        req_slope  = float(np.polyfit(turns, req_kbs, 1)[0])
+        req_growth = float(req_kbs[-1] / max(req_kbs[0], 0.01))
+        req_cv     = float(np.std(req_kbs) / max(np.mean(req_kbs), 0.01))
+        mono_frac  = float(
+            sum(req_kbs[i + 1] > req_kbs[i] for i in range(len(req_kbs) - 1))
+            / (len(req_kbs) - 1)
+        )
+        delta_reqs = [req_kbs[i + 1] - req_kbs[i] for i in range(len(req_kbs) - 1)]
+        prev_res   = [res_kbs[i]                   for i in range(len(res_kbs) - 1)]
+        valid      = [(d, r) for d, r in zip(delta_reqs, prev_res) if r > 0]
+        if len(valid) >= 2:
+            d_arr, r_arr   = np.array([v[0] for v in valid]), np.array([v[1] for v in valid])
+            delta_res_corr  = float(np.corrcoef(d_arr, r_arr)[0, 1])
+            delta_res_ratio = float(np.mean(d_arr / r_arr))
+        else:
+            delta_res_corr = delta_res_ratio = float("nan")
+    else:
+        req_slope = req_growth = req_cv = float("nan")
+        mono_frac = delta_res_corr = delta_res_ratio = float("nan")
+
+    small_ups = lens[up_m][lens[up_m] < 200]
+    idle_med  = float(np.median(small_ups)) if len(small_ups) >= 3 else float("nan")
+
+    return {
+        "http_ver":        http_ver,
+        "n_pkts":          int(len(ps)),
+        "bytes_up":        bytes_up,
+        "bytes_dn":        bytes_dn,
+        "up_frac":         bytes_up / total,
+        "pkt_std":         float(lens.std()),
+        "pkt_p95":         float(np.percentile(lens, 95)),
+        "pkt_median":      float(np.median(lens)),
+        "frac_ack":        float(np.mean(lens < 100)),
+        "idle_up_med":     idle_med,
+        "iat_max_ms":      float(iats.max()),
+        "flow_dur_s":      float(ts[-1] - ts[0]),
+        "n_requests":      len(requests),
+        "req_slope":       req_slope,
+        "req_growth":      req_growth,
+        "req_cv":          req_cv,
+        "mono_frac":       mono_frac,
+        "delta_res_corr":  delta_res_corr,
+        "delta_res_ratio": delta_res_ratio,
+    }
+
+
+def nan_to_none(obj: object) -> object:
+    """Recursively replace float NaN with None for JSON serialisation."""
+    if isinstance(obj, dict):
+        return {k: nan_to_none(v) for k, v in obj.items()}
+    if isinstance(obj, list):
+        return [nan_to_none(v) for v in obj]
+    if isinstance(obj, float) and math.isnan(obj):
+        return None
+    return obj

{network_core-0.2.2 → network_core-0.3.0}/network_core/conn.py

@@ -47,7 +47,30 @@ class Connection:
         self.packet_stream: List[PacketInfo] = []
         self.other_info = other_info
         self.__sni = None
+        self.__alpn = None
         self.is_quic = False
+        self._stats_dirty = True
+        self._up_bytes_c = 0
+        self._down_bytes_c = 0
+        self._up_packets_c = 0
+        self._down_packets_c = 0
+
+    def _build_stats(self):
+        if not self._stats_dirty:
+            return
+        up_b = dn_b = up_p = dn_p = 0
+        for p in self.packet_stream:
+            if p.direction == 0:
+                up_b += p.length
+                up_p += 1
+            else:
+                dn_b += p.length
+                dn_p += 1
+        self._up_bytes_c = up_b
+        self._down_bytes_c = dn_b
+        self._up_packets_c = up_p
+        self._down_packets_c = dn_p
+        self._stats_dirty = False
 
     @staticmethod
     def getTransPortType(packet):
@@ -91,6 +114,7 @@ class Connection:
             assert False, "Packet Type is Unknown"
         self.connection_type.add(packet.packet_type)
         self.packet_stream.append(packet)
+        self._stats_dirty = True
 
     def __len__(self):
         return len(self.packet_stream)
@@ -101,6 +125,12 @@ class Connection:
     def getSNI(self):
         return self.__sni
 
+    def setALPN(self, alpn: str):
+        self.__alpn = alpn
+
+    def getALPN(self) -> str | None:
+        return self.__alpn
+
     def getPacketsOfTypes(self, packet_types: set[PacketType]) -> List[PacketInfo]:
         return list(filter(lambda x: x.packet_type in packet_types, self.packet_stream))
 
@@ -149,35 +179,23 @@ class Connection:
 
     @property
     def down_bytes(self):
-        total = 0
-        for p in self.packet_stream:
-            if p.direction == 1:
-                total += p.length
-        return total
+        self._build_stats()
+        return self._down_bytes_c
 
     @property
     def up_bytes(self):
-        total = 0
-        for p in self.packet_stream:
-            if p.direction == 0:
-                total += p.length
-        return total
+        self._build_stats()
+        return self._up_bytes_c
 
     @property
     def down_packets(self):
-        total = 0
-        for p in self.packet_stream:
-            if p.direction == 1:
-                total += 1
-        return total
+        self._build_stats()
+        return self._down_packets_c
 
     @property
     def up_packets(self):
-        total = 0
-        for p in self.packet_stream:
-            if p.direction == 0:
-                total += 1
-        return total
+        self._build_stats()
+        return self._up_packets_c
 
     @property
     def start_timestamp(self):

network_core-0.3.0/network_core/utils/dt.py

@@ -0,0 +1,60 @@
+import calendar
+import datetime, pytz
+
+
+def convertUNIXToDT(timestamp: float, timezone="Australia/Sydney") -> datetime.datetime:
+    australian_timezone = pytz.timezone(timezone)
+    utc_dt = datetime.datetime.fromtimestamp(timestamp, tz=pytz.utc)
+    return utc_dt.astimezone(australian_timezone)
+
+
+def convertUNIXToHumanReadable(timestamp: float, timezone="Australia/Sydney") -> str:
+    dt = convertUNIXToDT(timestamp=timestamp, timezone=timezone)
+    ms = dt.microsecond // 1000  # get milliseconds, doing this so it isn't 0
+    return dt.strftime("%Y-%m-%d %H:%M:%S") + f".{ms}"
+
+
+def getDatetimeFromTime(time: datetime.time) -> datetime.datetime:
+    return datetime.datetime.combine(datetime.datetime.today(), time=time)
+
+
+def addBufferToTime(time: datetime.time, buffer_in_seconds: float) -> datetime.time:
+    delta = datetime.timedelta(seconds=buffer_in_seconds)
+    return (getDatetimeFromTime(time=time) + delta).time()
+
+
+def fast_strptime(s: str) -> float:
+    """Parse '2026-01-11 12:25:31.689768 +0530 IST' to a UNIX timestamp float.
+
+    Avoids datetime.strptime (slow format-string regex) by parsing integers
+    directly. ~5-10x faster when called per-packet on large CSV files.
+    """
+    parts = s.split()
+    # parts[0]=date  parts[1]=time  parts[2]=offset  parts[3]=tz_name (optional)
+    dp = parts[0]   # "2026-01-11"
+    tp = parts[1]   # "12:25:31.689768" or "12:25:31"
+    op = parts[2] if len(parts) > 2 else "+0000"
+
+    y  = int(dp[0:4])
+    mo = int(dp[5:7])
+    d  = int(dp[8:10])
+
+    dot = tp.find(".")
+    if dot >= 0:
+        hms = tp[:dot]
+        frac_str = tp[dot + 1 : dot + 7]           # max 6 digits (microseconds)
+        microseconds = int(frac_str.ljust(6, "0"))
+    else:
+        hms = tp
+        microseconds = 0
+
+    h   = int(hms[0:2])
+    m   = int(hms[3:5])
+    sec = int(hms[6:8])
+
+    sign = 1 if op[0] == "+" else -1
+    offset_secs = sign * (int(op[1:3]) * 3600 + int(op[3:5]) * 60)
+
+    # calendar.timegm treats the tuple as UTC; subtract offset to convert to UTC
+    utc_ts = calendar.timegm((y, mo, d, h, m, sec, 0, 0, 0))
+    return utc_ts - offset_secs + microseconds / 1_000_000

network_core-0.3.0/network_core/utils/pcapIO.py

@@ -0,0 +1,162 @@
+from scapy.all import PcapReader
+from network_core.conn import Connection, getPacketInfoFromPacket
+from network_core.dataModels import TransPortType, FiveTuple, PacketInfo, PacketType
+
+from ..sni.clientHello import quic_ch, tls_ch
+from .csvIO import read_csv_to_dicts
+from .dt import fast_strptime
+
+
+def getConnMp(pcap_path: str, put_snis=True, remove_payload=True):
+    """
+    If remove payload I will null the transport payload for connection
+
+    This will return a connection map mapping FiveTuple object to Connection
+    """
+    conn_mp: dict[FiveTuple, Connection] = {}
+
+    with PcapReader(pcap_path) as pcap_reader:
+        for packet in pcap_reader:
+            temp_conn = Connection.getConnFromPacket(packet=packet)
+            if temp_conn is None:
+                continue
+            key = temp_conn.five_tuple
+            rev_key = temp_conn.five_tuple.rev_ft()
+
+            direction = 0  # outgoing
+
+            if key not in conn_mp and rev_key not in conn_mp:
+                conn_mp[key] = temp_conn
+                temp_conn.addPacket(
+                    getPacketInfoFromPacket(packet=packet, direction=direction)
+                )
+
+            if key in conn_mp:
+                conn_mp[key].addPacket(
+                    getPacketInfoFromPacket(packet=packet, direction=direction)
+                )
+            elif rev_key in conn_mp:
+                direction = 1  # incoming
+                conn_mp[rev_key].addPacket(
+                    getPacketInfoFromPacket(packet=packet, direction=direction)
+                )
+
+    for _, conn in conn_mp.items():
+        conn.sort()
+
+    if put_snis:
+        for _, conn in conn_mp.items():
+            sni: str | None = None
+            if conn.five_tuple.transport_type == TransPortType.TCP:
+                ch_dict = tls_ch(connection=conn)
+                if ch_dict is None:
+                    continue
+                else:
+                    sni = ch_dict["snis"][0]
+                    conn.setSNI(sni)  # type: ignore
+            elif conn.five_tuple.transport_type == TransPortType.UDP:
+                ch_dict = quic_ch(connection=conn)
+                if ch_dict is None:
+                    continue
+                else:
+                    sni = ch_dict["snis"][0]
+                    conn.setSNI(sni)  # type: ignore
+                    conn.is_quic = True
+
+            if remove_payload:
+                # This removes payload
+                conn.removePayload()
+
+    return conn_mp
+
+
+# ---------------------------------------------------------------------------
+# CSV loading path (faster than pcap for post-processed data)
+# ---------------------------------------------------------------------------
+
+
+def _ft_from_go_string(tuple_str: str) -> FiveTuple:
+    """Parse the Go extractor five-tuple format.
+
+    Example: '192.168.31.246:64841->49.44.204.59:443->(Protocol: 6)'
+    """
+    parts = tuple_str.split("->")
+    src = parts[0].strip()
+    dst = parts[1].strip()
+    src_port = int(src.split(":")[-1])
+    dst_port = int(dst.split(":")[-1])
+    src_ip = ":".join(src.split(":")[:-1])
+    dst_ip = ":".join(dst.split(":")[:-1])
+
+    protocol = parts[2].strip().split(":")[-1].strip(")").strip()
+    if protocol == "6":
+        transport_type = TransPortType.TCP
+    elif protocol == "17":
+        transport_type = TransPortType.UDP
+    else:
+        transport_type = TransPortType.UNKNOWN
+
+    return FiveTuple(
+        src_ip=src_ip,
+        dst_ip=dst_ip,
+        src_port=src_port,
+        dst_port=dst_port,
+        transport_type=transport_type,
+    )
+
+
+def _packet_from_csv_row(row: dict, transport_type: TransPortType) -> PacketInfo:
+    if transport_type == TransPortType.TCP:
+        packet_type = PacketType.TCP
+    elif transport_type == TransPortType.UDP:
+        packet_type = PacketType.UDP
+    else:
+        packet_type = PacketType.UNKNOWN
+
+    return PacketInfo(
+        length=int(row["PacketLength"]),
+        timestamp=fast_strptime(row["Timestamp"]),
+        direction=int(row["Direction"]),
+        other_info={},
+        packet_type=packet_type,
+    )
+
+
+def get_connections_from_csv(
+    packets_csv_path: str,
+    flows_csv_path: str,
+) -> list[Connection]:
+    """Build Connection objects from the CSVs produced by the Go flow extractor.
+
+    Faster than getConnMp() for post-processed data because it skips Scapy
+    packet parsing and TLS/QUIC SNI re-extraction (SNI is already in the flows CSV).
+
+    packets_csv_path — path to the *Packets.csv (FlowId, PacketLength, Timestamp, Direction)
+    flows_csv_path   — path to the *Flows.csv   (FlowId, FiveTuple, StartTime, EndTime, SNI[, ALPN])
+    """
+    flow_index: dict[str, dict] = {}
+    for row in read_csv_to_dicts(flows_csv_path):
+        flow_index[row["FlowId"]] = {
+            "five_tuple": _ft_from_go_string(row["FiveTuple"]),
+            "sni": row["SNI"],
+            "alpn": row.get("ALPN", "nan"),
+        }
+
+    conns: dict[str, Connection] = {}
+    for row in read_csv_to_dicts(packets_csv_path):
+        fid = row["FlowId"]
+        if fid not in conns:
+            info = flow_index[fid]
+            c = Connection(five_tuple=info["five_tuple"])
+            c.setSNI(info["sni"])
+            if info["alpn"] and info["alpn"] != "nan":
+                c.setALPN(info["alpn"])
+            conns[fid] = c
+        conns[fid].addPacket(
+            _packet_from_csv_row(row, conns[fid].five_tuple.transport_type)
+        )
+
+    conn_list = list(conns.values())
+    for c in conn_list:
+        c.sort()
+    return conn_list

{network_core-0.2.2 → network_core-0.3.0}/network_core.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: network_core
-Version: 0.2.2
+Version: 0.3.0
 Summary: Core networking utilities and data models
 Author: Your Name
 Requires-Python: >=3.9
@@ -13,3 +13,4 @@ Requires-Dist: scapy
 Requires-Dist: matplotlib
 Requires-Dist: brotli
 Requires-Dist: blackboxprotobuf
+Requires-Dist: cryptography

{network_core-0.2.2 → network_core-0.3.0}/network_core.egg-info/SOURCES.txt

@@ -1,5 +1,6 @@
 pyproject.toml
 network_core/__init__.py
+network_core/analysis.py
 network_core/conn.py
 network_core/connOps.py
 network_core/dataModels.py

{network_core-0.2.2 → network_core-0.3.0}/network_core.egg-info/requires.txt

@@ -6,3 +6,4 @@ scapy
 matplotlib
 brotli
 blackboxprotobuf
+cryptography

{network_core-0.2.2 → network_core-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "network_core"
-version = "0.2.2"
+version = "0.3.0"
 description = "Core networking utilities and data models"
 authors = [{ name = "Your Name" }]
 readme = "README.md"
@@ -14,7 +14,8 @@ dependencies = [
     "scapy",
     "matplotlib",
     "brotli",
-    "blackboxprotobuf"
+    "blackboxprotobuf",
+    "cryptography"
 ]
 
 [build-system]

network_core-0.2.2/network_core/utils/dt.py

@@ -1,47 +0,0 @@
-import datetime, pytz
-
-
-def convertUNIXToDT(timestamp: float, timezone="Australia/Sydney") -> datetime.datetime:
-    australian_timezone = pytz.timezone(timezone)
-    utc_dt = datetime.datetime.fromtimestamp(timestamp, tz=pytz.utc)
-    return utc_dt.astimezone(australian_timezone)
-
-
-def convertUNIXToHumanReadable(timestamp: float, timezone="Australia/Sydney") -> str:
-    dt = convertUNIXToDT(timestamp=timestamp, timezone=timezone)
-    ms = dt.microsecond // 1000  # get milliseconds, doing this so it isn't 0
-    return dt.strftime("%Y-%m-%d %H:%M:%S") + f".{ms}"
-
-
-def getDatetimeFromTime(time: datetime.time) -> datetime.datetime:
-    return datetime.datetime.combine(datetime.datetime.today(), time=time)
-
-
-def addBufferToTime(time: datetime.time, buffer_in_seconds: float) -> datetime.time:
-    delta = datetime.timedelta(seconds=buffer_in_seconds)
-    return (getDatetimeFromTime(time=time) + delta).time()
-
-
-def fast_strptime(s: str) -> float:
-    """
-    2026-01-11 12:25:31.689768 +0530 IST to UNIX
-    """
-    parts = s.split()
-
-    # Drop trailing timezone name (like 'UTC', 'AEDT', etc.)
-    if len(parts) > 3:
-        s = " ".join(parts[:3])
-    else:
-        s = " ".join(parts)
-
-    # Handle too many fractional digits (datetime only supports microseconds)
-    date, time_str, offset = s.split()
-    if "." in time_str:
-        main, frac = time_str.split(".")
-        frac = frac[:6]  # truncate nanoseconds to microseconds
-        time_str = f"{main}.{frac}"
-    s = f"{date} {time_str} {offset}"
-
-    fmt = "%Y-%m-%d %H:%M:%S.%f %z" if "." in time_str else "%Y-%m-%d %H:%M:%S %z"
-
-    return datetime.datetime.strptime(s, fmt).timestamp()

network_core-0.2.2/network_core/utils/pcapIO.py

@@ -1,68 +0,0 @@
-from scapy.all import PcapReader
-from network_core.conn import Connection, getPacketInfoFromPacket
-from network_core.dataModels import TransPortType, FiveTuple
-
-from ..sni.clientHello import quic_ch, tls_ch
-
-
-def getConnMp(pcap_path: str, put_snis=True, remove_payload=True):
-    """
-    If remove payload I will null the transport payload for connection
-
-    This will return a connection map mapping FiveTuple object to Connection
-    """
-    conn_mp: dict[FiveTuple, Connection] = {}
-
-    with PcapReader(pcap_path) as pcap_reader:
-        for packet in pcap_reader:
-            temp_conn = Connection.getConnFromPacket(packet=packet)
-            if temp_conn is None:
-                continue
-            key = temp_conn.five_tuple
-            rev_key = temp_conn.five_tuple.rev_ft()
-
-            direction = 0  # outgoing
-
-            if key not in conn_mp and rev_key not in conn_mp:
-                conn_mp[key] = temp_conn
-                temp_conn.addPacket(
-                    getPacketInfoFromPacket(packet=packet, direction=direction)
-                )
-
-            if key in conn_mp:
-                conn_mp[key].addPacket(
-                    getPacketInfoFromPacket(packet=packet, direction=direction)
-                )
-            elif rev_key in conn_mp:
-                direction = 1  # incoming
-                conn_mp[rev_key].addPacket(
-                    getPacketInfoFromPacket(packet=packet, direction=direction)
-                )
-
-    for _, conn in conn_mp.items():
-        conn.sort()
-
-    if put_snis:
-        for _, conn in conn_mp.items():
-            sni: str | None = None
-            if conn.five_tuple.transport_type == TransPortType.TCP:
-                ch_dict = tls_ch(connection=conn)
-                if ch_dict is None:
-                    continue
-                else:
-                    sni = ch_dict["snis"][0]
-                    conn.setSNI(sni)  # type: ignore
-            elif conn.five_tuple.transport_type == TransPortType.UDP:
-                ch_dict = quic_ch(connection=conn)
-                if ch_dict is None:
-                    continue
-                else:
-                    sni = ch_dict["snis"][0]
-                    conn.setSNI(sni)  # type: ignore
-                    conn.is_quic = True
-
-            if remove_payload:
-                # This removes payload
-                conn.removePayload()
-
-    return conn_mp