traffic-taffy 0.2__tar.gz → 0.3.5__tar.gz

{traffic-taffy-0.2 → traffic-taffy-0.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: traffic-taffy
-Version: 0.2
+Version: 0.3.5
 Summary: A tool for doing differential analysis of pcap files
 Home-page: https://github.com/hardaker/traffic-taffy
 Author: Wes Hardaker

{traffic-taffy-0.2 → traffic-taffy-0.3.5}/setup.py

@@ -5,7 +5,7 @@ with open("README.md", "r") as fh:
 
 setuptools.setup(
     name="traffic-taffy",
-    version="0.2",
+    version="0.3.5",
     author="Wes Hardaker",
     author_email="opensource@hardakers.net",
     description="A tool for doing differential analysis of pcap files",
@@ -28,4 +28,11 @@ setuptools.setup(
     python_requires=">=3.7",
     test_suite="nose.collector",
     tests_require=["nose"],
+    install_requires=[
+        "pandas",
+        "rich",
+        "seaborn",
+        "scapy",
+        "dpkt",
+    ],
 )

{traffic-taffy-0.2 → traffic-taffy-0.3.5}/traffic_taffy/cache_info.py

@@ -47,6 +47,12 @@ def main():
     for key in contents["parameters"]:
         print(f"    {key:<16} {contents['parameters'][key]}")
 
+    print("data info:")
+    timestamps = list(contents["dissection"].keys())
+    print(f"    timestamps:      {len(timestamps)}")
+    print(f"    first:           {timestamps[1]}")  # skips 0 = global
+    print(f"    last:            {timestamps[-1]}")
+
 
 if __name__ == "__main__":
     main()

{traffic-taffy-0.2 → traffic-taffy-0.3.5}/traffic_taffy/compare.py

@@ -1,7 +1,7 @@
 """Takes a set of pcap files to compare and creates a report"""
 
 import logging
-from logging import info
+from logging import info, debug
 from argparse import ArgumentParser, ArgumentDefaultsHelpFormatter
 from typing import List
 from rich.console import Console
@@ -33,6 +33,7 @@ class PcapCompare:
         only_negative: bool = False,
         cache_results: bool = False,
         dissection_level: PCAPDissectorType = PCAPDissectorType.COUNT_ONLY,
+        between_times: List[int] | None = None,
     ) -> None:
         self.pcaps = pcaps
         self.deep = deep
@@ -45,40 +46,45 @@ class PcapCompare:
         self.only_negative = only_negative
         self.cache_results = cache_results
         self.dissection_level = dissection_level
+        self.between_times = between_times
 
-    def compare_results(self, report1: dict, report2: dict) -> dict:
+    @property
+    def reports(self):
+        return self._reports
+
+    @reports.setter
+    def reports(self, newvalue):
+        self._reports = newvalue
+
+    def compare_dissections(self, dissection1: dict, dissection2: dict) -> dict:
         "compares the results from two reports"
 
         # TODO: handle recursive depths, where items are subtrees rather than Counters
 
         report = {}
 
-        # TODO: we're only (currently) doing full pcap compares
-        report1 = report1[0]
-        report2 = report2[0]
-
-        # TODO: missing key in report2 (major items added)
-        for key in report1:
+        # TODO: missing key in dissection2 (major items added)
+        for key in dissection1:
             # TODO: deal with missing keys from one set
-            report1_total = report1[key].total()
-            report2_total = report2[key].total()
+            dissection1_total = dissection1[key].total()
+            dissection2_total = dissection2[key].total()
             report[key] = {}
 
-            for subkey in report1[key].keys():
+            for subkey in dissection1[key].keys():
                 delta = 0.0
                 total = 0
-                if subkey in report1[key] and subkey in report2[key]:
+                if subkey in dissection1[key] and subkey in dissection2[key]:
                     delta = (
-                        report2[key][subkey] / report2_total
-                        - report1[key][subkey] / report1_total
+                        dissection2[key][subkey] / dissection2_total
+                        - dissection1[key][subkey] / dissection1_total
                     )
-                    total = report2[key][subkey] + report1[key][subkey]
-                    ref_count = report1[key][subkey]
-                    comp_count = report2[key][subkey]
+                    total = dissection2[key][subkey] + dissection1[key][subkey]
+                    ref_count = dissection1[key][subkey]
+                    comp_count = dissection2[key][subkey]
                 else:
                     delta = -1.0
-                    total = report1[key][subkey]
-                    ref_count = report1[key][subkey]
+                    total = dissection1[key][subkey]
+                    ref_count = dissection1[key][subkey]
                     comp_count = 0
 
                 report[key][subkey] = {
@@ -88,12 +94,12 @@ class PcapCompare:
                     "comp_count": comp_count,
                 }
 
-            for subkey in report2[key].keys():
+            for subkey in dissection2[key].keys():
                 if subkey not in report[key]:
                     delta = 1.0
-                    total = report2[key][subkey]
+                    total = dissection2[key][subkey]
                     ref_count = 0
-                    comp_count = report2[key][subkey]
+                    comp_count = dissection2[key][subkey]
 
                     report[key][subkey] = {
                         "delta": delta,
@@ -136,6 +142,7 @@ class PcapCompare:
 
     def print_report(self, report: dict) -> None:
         "prints a report to the console"
+
         console = Console()
         for key in sorted(report):
             reported: bool = False
@@ -180,16 +187,11 @@ class PcapCompare:
     def print(self) -> None:
         "outputs the results"
         for n, report in enumerate(self.reports):
-            print(f"************ report #{n}")
-            self.print_report(report)
-
-    def compare(self) -> None:
-        "Compares each pcap against the original source"
-
-        reports = []
-
-        # TODO: use parallel processes to load multiple at a time
+            title = report.get("title", f"report #{n}")
+            print(f"************ {title}")
+            self.print_report(report["report"])
 
+    def load_pcaps(self) -> None:
         # load the first as a reference pcap
         info(f"reading pcap files using level={self.dissection_level}")
         pdm = PCAPDissectMany(
@@ -201,11 +203,71 @@ class PcapCompare:
             dissector_level=self.dissection_level,
         )
         results = pdm.load_all()
+        return results
+
+    def compare(self) -> None:
+        "Compares each pcap against the original source"
+
+        results = self.load_pcaps()
+        self.compare_all(results)
 
-        reference = next(results)
-        for other in results:
-            # compare the two
-            reports.append(self.compare_results(reference["data"], other["data"]))
+    def compare_all(self, results):
+        reports = []
+        if len(self.pcaps) > 1:
+            # multiple file comparison
+            reference = next(results)
+            for other in results:
+                # compare the two global summaries
+                reports.append(
+                    {
+                        "report": self.compare_dissections(
+                            reference["data"][0], other["data"][0]
+                        ),
+                        "title": f"{reference['file']} vs {other['file']}",
+                    }
+                )
+
+        else:
+            # deal with timestamps within a single file
+            results = list(results)
+            reference = results[0]
+            timestamps = list(reference["data"].keys())
+            debug(
+                f"found {len(timestamps)} timestamps from {timestamps[2]} to {timestamps[-1]}"
+            )
+            for timestamp in range(
+                2, len(timestamps)
+            ):  # second real non-zero timestamp to last
+                time_left = timestamps[timestamp - 1]
+                time_right = timestamps[timestamp]
+
+                # see if we were asked to only use particular time ranges
+                if self.between_times and (
+                    time_left < self.between_times[0]
+                    or time_right > self.between_times[1]
+                ):
+                    # debug(f"skipping timestamps {time_left} and {time_right}")
+                    continue
+
+                debug(f"comparing timestamps {time_left} and {time_right}")
+
+                report = self.compare_dissections(
+                    reference["data"][time_left], reference["data"][time_right]
+                )
+
+                title = f"time {time_left} vs time {time_right}"
+                print(f"************ {title}")
+                self.print_report(report)
+
+                continue
+
+                # takes way too much memory to do it "right"
+                # reports.append(
+                #     {
+                #         "report": report,
+                #         "title": f"time {time_left} vs time {time_right}",
+                #     }
+                # )
 
         self.reports = reports
 
@@ -236,6 +298,14 @@ def parse_args():
         "-N", "--only-negative", action="store_true", help="Only show negative entries"
     )
 
+    limiting_parser.add_argument(
+        "-T",
+        "--between-times",
+        nargs=2,
+        type=int,
+        help="For single files, only display results between these timestamps",
+    )
+
     dissector_add_parseargs(parser)
 
     debugging_group = parser.add_argument_group("Debugging options")
@@ -270,6 +340,7 @@ def main():
         only_negative=args.only_negative,
         cache_results=args.cache_pcap_results,
         dissection_level=args.dissection_level,
+        between_times=args.between_times,
     )
 
     # compare the pcaps

{traffic-taffy-0.2 → traffic-taffy-0.3.5}/traffic_taffy/dissectmany.py

@@ -32,7 +32,7 @@ class PCAPDissectMany:
         pd.load()
         return pd.data
 
-    def load_pcap(self, pcap_file, split_size=100000, maximum_count=0):
+    def load_pcap(self, pcap_file, split_size=None, maximum_count=0):
         pd = PCAPDissector(
             pcap_file,
             *self.args,

{traffic-taffy-0.2 → traffic-taffy-0.3.5}/traffic_taffy/dissector.py

@@ -110,6 +110,50 @@ class PCAPDissector:
                     data[timestamp][key]
                 )
 
+    @staticmethod
+    def open_maybe_compressed(filename):
+        """Opens a pcap file, potentially decompressing it."""
+
+        magic_dict = {
+            bytes([0x1F, 0x8B, 0x08]): "gz",
+            bytes([0x42, 0x5A, 0x68]): "bz2",
+            bytes([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00]): "xz",
+        }
+        max_len = max(len(x) for x in magic_dict)
+
+        base_handle = open(filename, "rb")
+        file_start = base_handle.read(max_len)
+        base_handle.close()
+
+        for magic, filetype in magic_dict.items():
+            if file_start.startswith(magic):
+                try:
+                    if filetype == "gz":
+                        import gzip
+
+                        return_handle = gzip.open(filename, "rb")
+                        return return_handle
+                    elif filetype == "bz2":
+                        import bz2
+
+                        return_handle = bz2.open(filename, "rb")
+                        setattr(return_handle, "name", filename)
+                        return return_handle
+                    elif filetype == "xz":
+                        import lzma
+
+                        return_handle = lzma.open(filename, "rb")
+                        return return_handle
+                    else:
+                        raise ValueError("unknown compression error")
+                except Exception:
+                    # likely we failed to find a compression module
+                    debug(f"failed to use {filetype} module to decode the input stream")
+                    raise ValueError("cannot decode file")
+
+        # return a raw file and hope it's not compressed'
+        return open(filename, "rb")
+
     def incr(self, key: str, value: Any, count: int = 1):
         # always save a total count at the zero bin
         # note: there should be no recorded tcpdump files from 1970 Jan 01 :-)
@@ -158,7 +202,7 @@ class PCAPDissector:
                 if parameter == "dissector_level":
                     debug("------------ here 1")
                 if parameter == "dissector_level" and specified <= cached:
-                    debug("here with dissector_level {specified} and {cached}")
+                    debug(f"here with dissector_level {specified} and {cached}")
                     # loading a more detailed cache is ok
                     continue
 
@@ -206,7 +250,7 @@ class PCAPDissector:
             self.timestamp = self.timestamp - self.timestamp % self.bin_size
         self.incr(self.TOTAL_COUNT, self.TOTAL_SUBKEY)
 
-        if self.dissector_level == PCAPDissectorType.THROUGH_IP.value:
+        if self.dissector_level >= PCAPDissectorType.THROUGH_IP.value:
             eth = dpkt.ethernet.Ethernet(packet)
             # these names are designed to match scapy names
             self.incr("Ethernet.dst", eth.dst)
@@ -262,7 +306,7 @@ class PCAPDissector:
     def load_via_dpkt(self) -> dict:
         self.data = {0: defaultdict(Counter)}
         if isinstance(self.pcap_file, str):
-            pcap = dpkt.pcap.Reader(open(self.pcap_file, "rb"))
+            pcap = dpkt.pcap.Reader(PCAPDissector.open_maybe_compressed(self.pcap_file))
         else:
             # it's an open handle already
             pcap = dpkt.pcap.Reader(self.pcap_file)
@@ -335,8 +379,11 @@ class PCAPDissector:
 
     def load_via_scapy(self) -> dict:
         "Loads a pcap file into a nested dictionary of statistical counts"
+        load_this = self.pcap_file
+        if isinstance(self.pcap_file, str):
+            load_this = PCAPDissector.open_maybe_compressed(self.pcap_file)
         sniff(
-            offline=self.pcap_file,
+            offline=load_this,
             prn=self.scapy_callback,
             store=0,
             count=self.maximum_count,
@@ -452,6 +499,14 @@ def dissector_add_parseargs(parser, add_subgroup: bool = True):
         help="Maximum number of packets to analyze",
     )
 
+    parser.add_argument(
+        "-b",
+        "--bin-size",
+        type=int,
+        default=3600,
+        help="Bin results into this many seconds",
+    )
+
     parser.add_argument(
         "-C",
         "--cache-pcap-results",
@@ -550,7 +605,7 @@ def main():
 
     pd = PCAPDissector(
         args.input_file,
-        bin_size=0,
+        bin_size=args.bin_size,
         dissector_level=args.dissection_level,
         maximum_count=args.packet_count,
         cache_results=args.cache_pcap_results,

traffic-taffy-0.3.5/traffic_taffy/explore.py

@@ -0,0 +1,222 @@
+import sys
+import logging
+from logging import info, debug
+from argparse import ArgumentParser, ArgumentDefaultsHelpFormatter
+from PyQt6.QtWidgets import QPushButton, QVBoxLayout, QLineEdit, QTextEdit, QWidget, QApplication, QLabel
+from traffic_taffy.dissector import (
+    PCAPDissectorType,
+    dissector_add_parseargs,
+    limitor_add_parseargs,
+    PCAPDissector,
+    check_dissector_level,
+)
+from traffic_taffy.compare import PcapCompare
+
+# https://stackoverflow.com/questions/32476006/how-to-make-an-expandable-collapsable-section-widget-in-qt
+
+# class Widget(QWidget):
+#     def __init__(self):
+#         super().__init__()
+#         self.__initUi()
+
+#     def __initUi(self):
+#         addBtn = QPushButton('Add')
+#         addBtn.clicked.connect(self.__add)
+#         self.__foldableListWidget = FoldableListWidget()
+#         lay = QVBoxLayout()
+#         lay.addWidget(addBtn)
+#         lay.addWidget(self.__foldableListWidget)
+#         self.setLayout(lay)
+
+#     def __add(self):
+#         foldedItem = QLabel("folded")
+# #        foldedItem.setPlaceholderText('Input...')
+
+#         sublist = FoldableListWidget()
+#         subitem1 = QLabel("main item")
+#         subitem2 = QLabel("sub item")
+#         sublist.setFoldableListWidgetItem(subitem1, subitem2)
+
+#         self.__foldableListWidget.setFoldableListWidgetItem(foldedItem, sublist)
+
+
+from PyQt6.QtWidgets import (QPushButton, QDialog, QTreeWidget,
+                             QTreeWidgetItem, QVBoxLayout,
+                             QHBoxLayout, QFrame, QLabel,
+                             QApplication)
+
+class SectionExpandButton(QPushButton):
+    """a QPushbutton that can expand or collapse its section
+    """
+    def __init__(self, item, text = "", parent = None):
+        super().__init__(text, parent)
+        self.section = item
+        self.clicked.connect(self.on_clicked)
+
+    def on_clicked(self):
+        """toggle expand/collapse of section by clicking
+        """
+        if self.section.isExpanded():
+            self.section.setExpanded(False)
+        else:
+            self.section.setExpanded(True)
+
+
+class TaffyExplorer(QDialog):
+    """Explore PCAP files by comparison slices"""
+    def __init__(self, args):
+        super().__init__()
+        self.tree = QTreeWidget()
+        self.tree.setHeaderHidden(True)
+        self.mainLayout = QVBoxLayout()
+        self.mainLayout.addWidget(self.tree)
+        self.setLayout(self.mainLayout)
+        self.tree.setIndentation(0)
+
+        self.sections = []
+        self.define_sections()
+        self.add_sections()
+
+        self.plusone = QPushButton("Add one")
+        self.mainLayout.addWidget(self.plusone)
+        self.plusone.clicked.connect(self.addone)
+
+        self.args = args
+
+    def addone(self):
+        print("here")
+        self.add_section("new item", QLabel("one thing"))
+
+    def add_section(self, title, widget):
+        button1 = self.add_button(title)
+        section1 = self.add_widget(button1, widget)
+        button1.addChild(section1)
+
+    def add_sections(self):
+        """adds a collapsible sections for every 
+        (title, widget) tuple in self.sections
+        """
+        #self.tree.clear()
+        for (title, widget) in self.sections:
+            self.add_section(title, widget)
+
+    def define_sections(self):
+        """reimplement this to define all your sections
+        and add them as (title, widget) tuples to self.sections
+        """
+        widget = QFrame(self.tree)
+        layout = QHBoxLayout(widget)
+        layout.addWidget(QLabel("Bla"))
+        layout.addWidget(QLabel("Blubb"))
+        title = "Section 1"
+        self.sections.append((title, widget))
+
+    def add_button(self, title):
+        """creates a QTreeWidgetItem containing a button 
+        to expand or collapse its section
+        """
+        item = QTreeWidgetItem()
+        self.tree.addTopLevelItem(item)
+        self.tree.setItemWidget(item, 0, SectionExpandButton(item, text = title))
+        return item
+
+    def add_widget(self, button, widget):
+        """creates a QWidgetItem containing the widget,
+        as child of the button-QWidgetItem
+        """
+        section = QTreeWidgetItem(button)
+        section.setDisabled(True)
+        self.tree.setItemWidget(section, 0, widget)
+        return section
+
+    def create_comparison(self):
+        self.pc = PcapCompare(
+            self.args.pcap_files,
+            maximum_count=self.args.packet_count,
+            print_threshold=float(self.args.print_threshold) / 100.0,
+            print_minimum_count=self.args.minimum_count,
+            print_match_string=self.args.match_string,
+            only_positive=self.args.only_positive,
+            only_negative=self.args.only_negative,
+            cache_results=self.args.cache_pcap_results,
+            dissection_level=self.args.dissection_level,
+            between_times=self.args.between_times,
+        )
+
+        # compare the pcaps
+        self.pcap_data = list(self.pc.load_pcaps())
+
+    def show_comparison(self, pcap_one, timestamp_one, pcap_two, timestamp_two):
+        
+
+
+def parse_args():
+    "Parse the command line arguments."
+    parser = ArgumentParser(
+        formatter_class=ArgumentDefaultsHelpFormatter,
+        description=__doc__,
+        epilog="Exmaple Usage: ",
+    )
+
+    limiting_parser = limitor_add_parseargs(parser)
+
+    limiting_parser.add_argument(
+        "-t",
+        "--print-threshold",
+        default=0.0,
+        type=float,
+        help="Don't print results with abs(percent) less than this threshold",
+    )
+
+    limiting_parser.add_argument(
+        "-P", "--only-positive", action="store_true", help="Only show positive entries"
+    )
+
+    limiting_parser.add_argument(
+        "-N", "--only-negative", action="store_true", help="Only show negative entries"
+    )
+
+    limiting_parser.add_argument(
+        "-T",
+        "--between-times",
+        nargs=2,
+        type=int,
+        help="For single files, only display results between these timestamps",
+    )
+
+    dissector_add_parseargs(parser)
+
+    debugging_group = parser.add_argument_group("Debugging options")
+
+    debugging_group.add_argument(
+        "--log-level",
+        "--ll",
+        default="info",
+        help="Define the logging verbosity level (debug, info, warning, error, ...).",
+    )
+
+    parser.add_argument("pcap_files", type=str, nargs="*", help="PCAP files to analyze")
+
+    args = parser.parse_args()
+    log_level = args.log_level.upper()
+    logging.basicConfig(level=log_level, format="%(levelname)-10s:\t%(message)s")
+
+    check_dissector_level(args.dissection_level)
+
+    return args
+
+
+def main():
+    args = parse_args()
+
+    app = QApplication(sys.argv)
+    window = TaffyExplorer(args)
+    window.create_comparison()
+    window.show()
+    sys.exit(app.exec())
+
+
+
+if __name__ == "__main__":
+    main()
+

{traffic-taffy-0.2 → traffic-taffy-0.3.5}/traffic_taffy/graph.py

@@ -26,14 +26,6 @@ def parse_args():
         epilog="Exmaple Usage: ",
     )
 
-    parser.add_argument(
-        "-g",
-        "--graph-elements",
-        default=None,
-        type=str,
-        help="Graph these particular elements; the default is packet counts",
-    )
-
     parser.add_argument(
         "-o",
         "--output-file",
@@ -49,14 +41,6 @@ def parse_args():
         help="Define verbosity level (debug, info, warning, error, fotal, critical).",
     )
 
-    parser.add_argument(
-        "-b",
-        "--bin-size",
-        type=int,
-        default=1,
-        help="Bin results into this many seconds",
-    )
-
     parser.add_argument(
         "-i",
         "--interactive",

{traffic-taffy-0.2 → traffic-taffy-0.3.5}/traffic_taffy/pcap_splitter.py

@@ -3,10 +3,11 @@
 import io
 import os
 import multiprocessing
+from traffic_taffy.dissector import PCAPDissector
 from typing import List
 import dpkt
 from concurrent.futures import ProcessPoolExecutor, Future
-from logging import debug
+from logging import debug, info
 
 
 class PCAPSplitter:
@@ -26,6 +27,7 @@ class PCAPSplitter:
         self.split_size: int = split_size
         self.maximum_count: int = maximum_count
         self.pcap_filter: str | None = pcap_filter
+        self.maximum_cores = maximum_cores
 
         self.header: bytes = None
         self.buffer: bytes = None
@@ -38,29 +40,46 @@ class PCAPSplitter:
         if not os.path.exists(self.pcap_file):
             raise ValueError(f"failed to find pcap file '{self.pcap_file}'")
 
-        if not self.split_size:
-            cores = multiprocessing.cpu_count()
-            if maximum_cores and cores > maximum_cores:
-                cores = maximum_cores
+    def set_split_size(self):
+        "Attempt to calculate a reasonable split size"
+        if self.split_size:
+            info(f"split size already set to {self.split_size}")
+            return self.split_size
 
-            if self.maximum_count:
-                # not ideal math, but better than nothing
-                self.split_size = int(self.maximum_count / cores)
+        cores = multiprocessing.cpu_count()
+        if self.maximum_cores and cores > self.maximum_cores:
+            cores = self.maximum_cores
+
+        if self.maximum_count and self.maximum_count > 0:
+            # not ideal math, but better than nothing
+            self.split_size = int(self.maximum_count / cores)
+        else:
+            if isinstance(self.our_data, io.BufferedReader):
+                # raw uncompressed file
+                divide_size = 1200
             else:
-                # even worse math and assumes generally large packets
-                stats = os.stat(self.pcap_file)
-                file_size = stats.st_size
-                self.split_size = int(file_size / 1200 / cores)
+                # likely a compressed file
+                divide_size = 5000
+
+            # even worse math and assumes generally large packets
+            stats = os.stat(self.pcap_file)
+            file_size = stats.st_size
+            self.split_size = int(file_size / divide_size / cores)
+            debug(
+                f"split info: {file_size=}, {divide_size=}, {cores=}, {self.split_size=}"
+            )
 
-            # even 1000 is kinda silly to split, but is better than nothing
-            self.split_size = min(self.split_size, 1000)
-            debug(f"setting PCAPSplitter split size to {self.split_size} for {cores}")
+        # even 1000 is kinda silly to split, but is better than nothing
+        self.split_size = max(self.split_size, 1000)
+        debug(f"setting PCAPSplitter split size to {self.split_size} for {cores} cores")
 
     def split(self) -> List[io.BytesIO] | List[Future]:
         "Does the actual reading and splitting"
         # open one for the dpkt reader and one for us independently
-        self.our_data = open(self.pcap_file, "rb")
-        self.dpkt_data = open(self.pcap_file, "rb")
+        self.our_data = PCAPDissector.open_maybe_compressed(self.pcap_file)
+        self.dpkt_data = PCAPDissector.open_maybe_compressed(self.pcap_file)
+
+        self.set_split_size()
 
         # read the first 24 bytes which is the pcap header
         self.header = self.our_data.read(24)

{traffic-taffy-0.2 → traffic-taffy-0.3.5}/traffic_taffy.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: traffic-taffy
-Version: 0.2
+Version: 0.3.5
 Summary: A tool for doing differential analysis of pcap files
 Home-page: https://github.com/hardaker/traffic-taffy
 Author: Wes Hardaker

{traffic-taffy-0.2 → traffic-taffy-0.3.5}/traffic_taffy.egg-info/SOURCES.txt

@@ -7,10 +7,12 @@ traffic_taffy/compare.py
 traffic_taffy/dissectmany.py
 traffic_taffy/dissector.py
 traffic_taffy/dissectorresults.py
+traffic_taffy/explore.py
 traffic_taffy/graph.py
 traffic_taffy/pcap_splitter.py
 traffic_taffy.egg-info/PKG-INFO
 traffic_taffy.egg-info/SOURCES.txt
 traffic_taffy.egg-info/dependency_links.txt
 traffic_taffy.egg-info/entry_points.txt
+traffic_taffy.egg-info/requires.txt
 traffic_taffy.egg-info/top_level.txt

traffic-taffy-0.3.5/traffic_taffy.egg-info/requires.txt

@@ -0,0 +1,5 @@
+pandas
+rich
+seaborn
+scapy
+dpkt