traffic-taffy 0.9.4__py3-none-any.whl → 0.9.6__py3-none-any.whl

traffic_taffy/__init__.py

@@ -1 +1 @@
-__VERSION__ = "0.9.4"
+__VERSION__ = "0.9.6"

traffic_taffy/dissection.py

@@ -134,8 +134,6 @@ class Dissection:
         # note: there should be no recorded tcpdump files from 1970 Jan 01 :-)
         self.data[0][key][value] += count
         if self.timestamp:
-            if self.timestamp not in self.data:
-                self.data[self.timestamp] = defaultdict(Counter)
             self.data[self.timestamp][key][value] += count
 
     def calculate_metadata(self: Dissection) -> None:
@@ -159,16 +157,6 @@ class Dissection:
         for timestamp in other_dissection.data:
             for key in other_dissection.data[timestamp]:
                 for subkey in other_dissection.data[timestamp][key]:
-                    # TODO(hardaker): this is horribly inefficient
-                    if timestamp not in self.data:
-                        self.data[timestamp] = defaultdict(Counter)
-                    elif key not in self.data[timestamp]:
-                        self.data[timestamp][key] = Counter()
-                    elif (
-                        isinstance(self.data[timestamp][key], dict)
-                        and subkey not in self.data[timestamp][key]
-                    ):
-                        self.data[timestamp][key][subkey] = 0
                     self.data[timestamp][key][subkey] += other_dissection.data[
                         timestamp
                     ][key][subkey]

traffic_taffy/dissector_engine/dpkt.py

@@ -8,6 +8,7 @@ from traffic_taffy.dissection import Dissection, PCAPDissectorLevel
 from pcap_parallel import PCAPParallel
 
 import dpkt
+import socket
 
 
 class DissectionEngineDpkt(DissectionEngine):
@@ -170,6 +171,10 @@ class DissectionEngineDpkt(DissectionEngine):
                 raise ValueError("unknown link type")
 
             # TODO(hardaker): add ip6.IP6 support
+            next_layer = None
+            udp = None
+            tcp = None
+
             if isinstance(data, dpkt.ip.IP):
                 ip = data
                 udp = None
@@ -197,8 +202,32 @@ class DissectionEngineDpkt(DissectionEngine):
                 self.incr(prefix + "version", ip.v)
                 self.incr(prefix + "ttl", ip.ttl)
 
-                if isinstance(ip.data, dpkt.udp.UDP):
-                    udp = ip.data
+                next_layer = ip.data
+
+            elif isinstance(data, dpkt.ip6.IP6):
+                ip6 = data
+
+                ipver = "IPv6"
+                prefix = f"Ethernet_{ipver}_"
+
+                # TODO(hardaker): make sure all these match scapy
+                socket.inet_ntop(
+                    socket.AF_INET6,
+                    b"\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01",
+                )
+
+                self.incr(prefix + "dst", socket.inet_ntop(socket.AF_INET6, ip6.dst))
+                self.incr(prefix + "src", socket.inet_ntop(socket.AF_INET6, ip6.src))
+                self.incr(prefix + "fl", ip6.flow)
+                self.incr(prefix + "hlim", ip6.hlim)
+                self.incr(prefix + "nh", ip6.nxt)
+                self.incr(prefix + "plen", ip6.plen)
+                self.incr(prefix + "tc", ip6.fc)
+                next_layer = ip6.data
+
+            if next_layer:
+                if isinstance(next_layer, dpkt.udp.UDP):
+                    udp = next_layer
                     self.incr(prefix + "UDP_sport", udp.sport)
                     self.incr(prefix + "UDP_dport", udp.dport)
                     self.incr(prefix + "UDP_len", udp.ulen)
@@ -206,8 +235,8 @@ class DissectionEngineDpkt(DissectionEngine):
 
                     # TODO(hardaker): handle DNS and others for level 3
 
-                elif isinstance(ip.data, dpkt.tcp.TCP):
-                    tcp = ip.data
+                elif isinstance(next_layer, dpkt.tcp.TCP):
+                    tcp = next_layer
                     self.incr(prefix + "TCP_sport", tcp.sport)
                     self.incr(prefix + "TCP_dport", tcp.dport)
                     self.incr(prefix + "TCP_seq", tcp.seq)

traffic_taffy/dissector_engine/scapy.py

@@ -113,6 +113,8 @@ class DissectionEngineScapy(DissectionEngine):
 
             try:
                 field_value = getattr(layer, field_name)
+                if not field_value:  ## can return empty field values like []
+                    continue
                 if hasattr(field_value, "fields"):
                     self.add_layer(field_value, new_prefix + "_")
                 else:

{traffic_taffy-0.9.4.dist-info → traffic_taffy-0.9.6.dist-info}/METADATA

@@ -1,10 +1,11 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: traffic-taffy
-Version: 0.9.4
+Version: 0.9.6
 Summary: A tool for doing differential analysis of pcap files
 Project-URL: Homepage, https://traffic-taffy.github.io/
 Author-email: Wes Hardaker <opensource@hardakers.net>
 License-File: LICENSE.txt
+Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.7

{traffic_taffy-0.9.4.dist-info → traffic_taffy-0.9.6.dist-info}/RECORD

@@ -1,13 +1,12 @@
-traffic_taffy/__init__.py,sha256=UI1Y766LRTQsBQeHgwpMOn6l2U43AJiA2KPxg4vVPO0,22
+traffic_taffy/__init__.py,sha256=9xmdbHPOaHkUt61kunVWy2yjchW2Zvmp7Ti49qS99iM,22
 traffic_taffy/compare.py,sha256=g9rU6oa_2Wy0nUJ7K6TI8JTctyGCRvYEUakDBf7blOY,8644
 traffic_taffy/comparison.py,sha256=KJxOp4UqhfRkF4LI1PMDRIefeyTm2w5sbdr7VUTS4KM,1451
 traffic_taffy/config.py,sha256=DgTu2kA1Ec4Hbwl_44kTsdyJYvxAabgJk9a7aOH2XXU,4444
-traffic_taffy/dissection.py,sha256=dW6UxJ_RY5oMipyh3J2CvsjP-E9Llly7IgjbPFSSTzU,24571
+traffic_taffy/dissection.py,sha256=DNxcXoNyk2lpJiaSzvAq1YHwHhYPY6xtlVkHTs-eb9Q,23904
 traffic_taffy/dissectmany.py,sha256=SWFXFyERNCi0j7hiMDEeJJdPYDpa0SOlSj1V8AqpXUA,5189
 traffic_taffy/dissector.py,sha256=M5MHVPwfeMHa6s4TG8ZiiNjk7qaht65wdqm0nmRHdQ8,15682
 traffic_taffy/graph.py,sha256=EfkxH5D9PNlDpvftkh9GyUusV05EV537QGB7JOMeW4w,4730
 traffic_taffy/graphdata.py,sha256=r_QNXO3FzC7Vx4123SdCliAh7j2NCQ4Lb5uoOJnlt2M,3376
-traffic_taffy/report.py,sha256=Yzb27hUWcWL-RxWpSQmRyM8NyWxQGT0l0jUCGHoYDSY,224
 traffic_taffy/taffy_config.py,sha256=AmdQbWAhoiV7aTNSpV1exJfd5eA0a3sYTIjikHkMPwY,1124
 traffic_taffy/algorithms/__init__.py,sha256=A7xI2ctotBT7WgG-6ItilXE_FIWF9QWc6UjdfGyThKw,737
 traffic_taffy/algorithms/comparecorrelation.py,sha256=gakZJotZNOVj96y4_-vtt_ka8pZLBVERf44Yixtq_yE,5875
@@ -17,8 +16,8 @@ traffic_taffy/algorithms/compareslices.py,sha256=aIDhISKi-m8uD65pBd3A2naoxYD9zea
 traffic_taffy/algorithms/statistical.py,sha256=0Hr62ZUZlFCNPUh6yVBRFjNho42cTGeX_GHtbq1sbak,4281
 traffic_taffy/dissector_engine/__init__.py,sha256=Hu-UQtz7yhivmQLUP5b8tFQLEhy2bfvrRV3Q4aZp6vg,2202
 traffic_taffy/dissector_engine/dnstap.py,sha256=rBzVlB0D3YVhHOsr17cbnCIZU13g20srgR4sE7ZfNUE,4810
-traffic_taffy/dissector_engine/dpkt.py,sha256=9JSyKBe2Ec0GItdmwo5mpzekg4Ua5NdpLnllhiV33Jg,11753
-traffic_taffy/dissector_engine/scapy.py,sha256=WrZUfV_viR2Tro0kM3QKUkufIcM3RyYaZ3ncA1yZsaU,4897
+traffic_taffy/dissector_engine/dpkt.py,sha256=q7cJz6WWpe9xUcEbAY_yn_cma_4loXuS3QKIVln6FHQ,12788
+traffic_taffy/dissector_engine/scapy.py,sha256=S3yrUmSeDjt3oE1I07L3iLFLF8Df8XAZg535FY_eu90,5004
 traffic_taffy/hooks/__init__.py,sha256=Bvhl6RnyBqQkWuCU6TS0O_ZHe4qCQsC4HE8FELigWPw,661
 traffic_taffy/hooks/ip2asn.py,sha256=7UA52L6jej0RYBptzP9izO0yXMcqH7wcp2ocDRUN5dg,2216
 traffic_taffy/hooks/labels.py,sha256=5jHXq3-kxDQj9PRYgak-gDzE8dvSUiCEq9mBs9nE014,1933
@@ -35,7 +34,6 @@ traffic_taffy/reports/correlationreport.py,sha256=9PdL_53mxfO619PFSoeRsTEm63L1J_
 traffic_taffy/tests/test_compare_results.py,sha256=iLcS9wvEqxgKszIspLtD2Zw8Qk5JxOCurQwWYzhtOkM,2318
 traffic_taffy/tests/test_config.py,sha256=UCqSJXVwpFFchcIbyFzLqjVF-wgEV755KlQ7thommro,4284
 traffic_taffy/tests/test_dict_merge.py,sha256=t3rZSQQ0AlBxRKfLborx9SxYN53cCAQQzZ2w-__WT2Y,1429
-traffic_taffy/tests/test_dpkt_engine.py,sha256=512Wfq7D1qVkfhGwf1u2QSgZooWqZQWV9L4OhpAr4AE,489
 traffic_taffy/tests/test_global_config.py,sha256=kjr1wy1cXWagVLb0OnQYH0vz2htxLs944Xo42lNsir4,597
 traffic_taffy/tests/test_hooks.py,sha256=amjEbtMwOZZCg_RCJ0wQR7aOqNfwz3IG3WY-9CwjSF4,1260
 traffic_taffy/tests/test_normalize.py,sha256=sKHyiV8YXcKKcWqsbZP94nu_g5oEMJzzj6umeHxwa64,2638
@@ -51,8 +49,8 @@ traffic_taffy/tools/dissect.py,sha256=B-7e7aqEOWtJ-0P2Y-mzmrzoDqVrDCJ2JzGR45Qtuu
 traffic_taffy/tools/explore.py,sha256=gUcOfAgangJJI1si1gLPUoWRUKmWUAXSP0oTD2JJygw,24149
 traffic_taffy/tools/export.py,sha256=9zBBGhZK95b4ZiLJ8XK30GPsaBjgR84Sk1HoPIxRpTI,2844
 traffic_taffy/tools/graph.py,sha256=KiKDY9R8JLT5-JouANoi_1WGcdFMhXsLnYlhPsFRWpM,2316
-traffic_taffy-0.9.4.dist-info/METADATA,sha256=JTazabFuUmC4sejWSCl5ib4E5A_iVEO8z7WuRnWGhHc,2241
-traffic_taffy-0.9.4.dist-info/WHEEL,sha256=TJPnKdtrSue7xZ_AVGkp9YXcvDrobsjBds1du3Nx6dc,87
-traffic_taffy-0.9.4.dist-info/entry_points.txt,sha256=F0lqjvw94nQ3hY4eerN7faT9aKhhGUHbqBhuEr9q1r8,361
-traffic_taffy-0.9.4.dist-info/licenses/LICENSE.txt,sha256=hiV1DJgDQeSM1r7P-ez5oxily11S5nsCedU0jKzKKzo,11338
-traffic_taffy-0.9.4.dist-info/RECORD,,
+traffic_taffy-0.9.6.dist-info/METADATA,sha256=pc-nZx_uzZb6DSBR1ZWCbDrKnHPVlkB6EhlSU4T9SWc,2304
+traffic_taffy-0.9.6.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+traffic_taffy-0.9.6.dist-info/entry_points.txt,sha256=F0lqjvw94nQ3hY4eerN7faT9aKhhGUHbqBhuEr9q1r8,361
+traffic_taffy-0.9.6.dist-info/licenses/LICENSE.txt,sha256=hiV1DJgDQeSM1r7P-ez5oxily11S5nsCedU0jKzKKzo,11338
+traffic_taffy-0.9.6.dist-info/RECORD,,

{traffic_taffy-0.9.4.dist-info → traffic_taffy-0.9.6.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.21.1
+Generator: hatchling 1.27.0
 Root-Is-Purelib: true
 Tag: py3-none-any

traffic_taffy/report.py

@@ -1,12 +0,0 @@
-from dataclasses import dataclass
-
-
-@dataclass
-class Report:
-    delta_percentage: float
-    delta_absolute: int
-    total: int
-    left_count: int
-    right_count: int
-    left_percentage: float
-    right_percentage: float

traffic_taffy/tests/test_dpkt_engine.py

@@ -1,15 +0,0 @@
-import os
-from traffic_taffy.dissection import PCAPDissectorLevel
-from traffic_taffy.dissector_engine.dpkt import DissectionEngineDpkt
-
-def test_dpkt_engine():
-    test_pcap = "dns.pcap"
-    test_pcap = "port53-2023-30-31_20.pcap"
-    test_pcap = "airplane-wireless.pcap"
-    if not os.path.exists(test_pcap):
-        return
-
-    engine = DissectionEngineDpkt(test_pcap,
-                                  dissector_level = PCAPDissectorLevel.COMMON_LAYERS)
-    dissection = engine.load()
-