traffic-taffy 0.9.4__tar.gz → 0.9.6__tar.gz

{traffic_taffy-0.9.4 → traffic_taffy-0.9.6}/PKG-INFO

@@ -1,10 +1,11 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: traffic-taffy
-Version: 0.9.4
+Version: 0.9.6
 Summary: A tool for doing differential analysis of pcap files
 Project-URL: Homepage, https://traffic-taffy.github.io/
 Author-email: Wes Hardaker <opensource@hardakers.net>
 License-File: LICENSE.txt
+Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.7

{traffic_taffy-0.9.4 → traffic_taffy-0.9.6}/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["hatchling"]
+requires = ["hatchling>=1.26.1"]
 build-backend = "hatchling.build"
 
 [project]
@@ -7,7 +7,10 @@ name = "traffic-taffy"
 dynamic = ["version"]
 description = "A tool for doing differential analysis of pcap files"
 readme = "README.md"
-license = ""
+# license = "Apache License, Version 2.0"
+# license = { file = "LICENSE.txt" }
+# license-expression = "Apache 2.0"
+# license-file = "LICENSE.txt"
 requires-python = ">=3.7"
 authors = [
     { name = "Wes Hardaker", email = "opensource@hardakers.net" },
@@ -15,6 +18,7 @@ authors = [
 classifiers = [
     "Operating System :: OS Independent",
     "Programming Language :: Python :: 3",
+    "License :: OSI Approved :: Apache Software License",
 ]
 dependencies = [
     "dpkt",
@@ -35,6 +39,10 @@ dependencies = [
     "argparse-with-config>=0.1.4",
 ]
 
+# [project.metadata]
+# license-expression = "Apache 2.0"
+# license-file = "LICENSE.txt"
+
 [project.package_data]
 "traffic_taffy.iana" = ['tables.msgpak']
 

traffic_taffy-0.9.6/traffic_taffy/__init__.py

@@ -0,0 +1 @@
+__VERSION__ = "0.9.6"

{traffic_taffy-0.9.4 → traffic_taffy-0.9.6}/traffic_taffy/dissection.py

@@ -134,8 +134,6 @@ class Dissection:
         # note: there should be no recorded tcpdump files from 1970 Jan 01 :-)
         self.data[0][key][value] += count
         if self.timestamp:
-            if self.timestamp not in self.data:
-                self.data[self.timestamp] = defaultdict(Counter)
             self.data[self.timestamp][key][value] += count
 
     def calculate_metadata(self: Dissection) -> None:
@@ -159,16 +157,6 @@ class Dissection:
         for timestamp in other_dissection.data:
             for key in other_dissection.data[timestamp]:
                 for subkey in other_dissection.data[timestamp][key]:
-                    # TODO(hardaker): this is horribly inefficient
-                    if timestamp not in self.data:
-                        self.data[timestamp] = defaultdict(Counter)
-                    elif key not in self.data[timestamp]:
-                        self.data[timestamp][key] = Counter()
-                    elif (
-                        isinstance(self.data[timestamp][key], dict)
-                        and subkey not in self.data[timestamp][key]
-                    ):
-                        self.data[timestamp][key][subkey] = 0
                     self.data[timestamp][key][subkey] += other_dissection.data[
                         timestamp
                     ][key][subkey]

{traffic_taffy-0.9.4 → traffic_taffy-0.9.6}/traffic_taffy/dissector_engine/dpkt.py

@@ -8,6 +8,7 @@ from traffic_taffy.dissection import Dissection, PCAPDissectorLevel
 from pcap_parallel import PCAPParallel
 
 import dpkt
+import socket
 
 
 class DissectionEngineDpkt(DissectionEngine):
@@ -170,6 +171,10 @@ class DissectionEngineDpkt(DissectionEngine):
                 raise ValueError("unknown link type")
 
             # TODO(hardaker): add ip6.IP6 support
+            next_layer = None
+            udp = None
+            tcp = None
+
             if isinstance(data, dpkt.ip.IP):
                 ip = data
                 udp = None
@@ -197,8 +202,32 @@ class DissectionEngineDpkt(DissectionEngine):
                 self.incr(prefix + "version", ip.v)
                 self.incr(prefix + "ttl", ip.ttl)
 
-                if isinstance(ip.data, dpkt.udp.UDP):
-                    udp = ip.data
+                next_layer = ip.data
+
+            elif isinstance(data, dpkt.ip6.IP6):
+                ip6 = data
+
+                ipver = "IPv6"
+                prefix = f"Ethernet_{ipver}_"
+
+                # TODO(hardaker): make sure all these match scapy
+                socket.inet_ntop(
+                    socket.AF_INET6,
+                    b"\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01",
+                )
+
+                self.incr(prefix + "dst", socket.inet_ntop(socket.AF_INET6, ip6.dst))
+                self.incr(prefix + "src", socket.inet_ntop(socket.AF_INET6, ip6.src))
+                self.incr(prefix + "fl", ip6.flow)
+                self.incr(prefix + "hlim", ip6.hlim)
+                self.incr(prefix + "nh", ip6.nxt)
+                self.incr(prefix + "plen", ip6.plen)
+                self.incr(prefix + "tc", ip6.fc)
+                next_layer = ip6.data
+
+            if next_layer:
+                if isinstance(next_layer, dpkt.udp.UDP):
+                    udp = next_layer
                     self.incr(prefix + "UDP_sport", udp.sport)
                     self.incr(prefix + "UDP_dport", udp.dport)
                     self.incr(prefix + "UDP_len", udp.ulen)
@@ -206,8 +235,8 @@ class DissectionEngineDpkt(DissectionEngine):
 
                     # TODO(hardaker): handle DNS and others for level 3
 
-                elif isinstance(ip.data, dpkt.tcp.TCP):
-                    tcp = ip.data
+                elif isinstance(next_layer, dpkt.tcp.TCP):
+                    tcp = next_layer
                     self.incr(prefix + "TCP_sport", tcp.sport)
                     self.incr(prefix + "TCP_dport", tcp.dport)
                     self.incr(prefix + "TCP_seq", tcp.seq)

{traffic_taffy-0.9.4 → traffic_taffy-0.9.6}/traffic_taffy/dissector_engine/scapy.py

@@ -113,6 +113,8 @@ class DissectionEngineScapy(DissectionEngine):
 
             try:
                 field_value = getattr(layer, field_name)
+                if not field_value:  ## can return empty field values like []
+                    continue
                 if hasattr(field_value, "fields"):
                     self.add_layer(field_value, new_prefix + "_")
                 else:

traffic_taffy-0.9.4/traffic_taffy/__init__.py

@@ -1 +0,0 @@
-__VERSION__ = "0.9.4"

traffic_taffy-0.9.4/traffic_taffy/report.py

@@ -1,12 +0,0 @@
-from dataclasses import dataclass
-
-
-@dataclass
-class Report:
-    delta_percentage: float
-    delta_absolute: int
-    total: int
-    left_count: int
-    right_count: int
-    left_percentage: float
-    right_percentage: float

traffic_taffy-0.9.4/traffic_taffy/tests/test_dpkt_engine.py

@@ -1,15 +0,0 @@
-import os
-from traffic_taffy.dissection import PCAPDissectorLevel
-from traffic_taffy.dissector_engine.dpkt import DissectionEngineDpkt
-
-def test_dpkt_engine():
-    test_pcap = "dns.pcap"
-    test_pcap = "port53-2023-30-31_20.pcap"
-    test_pcap = "airplane-wireless.pcap"
-    if not os.path.exists(test_pcap):
-        return
-
-    engine = DissectionEngineDpkt(test_pcap,
-                                  dissector_level = PCAPDissectorLevel.COMMON_LAYERS)
-    dissection = engine.load()
-