xbase-util 0.7.9__tar.gz → 0.8.1__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {xbase_util-0.7.9 → xbase_util-0.8.1}/PKG-INFO +1 -1
- {xbase_util-0.7.9 → xbase_util-0.8.1}/setup.py +1 -1
- {xbase_util-0.7.9 → xbase_util-0.8.1}/test/test.py +3 -1
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/pcap_util.py +6 -5
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util.egg-info/PKG-INFO +1 -1
- {xbase_util-0.7.9 → xbase_util-0.8.1}/README.md +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/setup.cfg +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/__init__.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/add_column_util.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/dangerous_util.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/__init__.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/bean/ConfigBean.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/bean/CurrentConfigBean.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/bean/FlowBean.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/bean/TaskTemplateBean.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/bean/__init__.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/dao/ConfigDao.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/dao/CurrentConfigDao.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/dao/FlowDao.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/dao/TaskTemplateDao.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/dao/__init__.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/initsqlite3.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/es_db_util.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/esreq.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/geo_util.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/handle_features_util.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/packet_util.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/xbase_constant.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/xbase_util.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util.egg-info/SOURCES.txt +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util.egg-info/dependency_links.txt +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util.egg-info/not-zip-safe +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util.egg-info/top_level.txt +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util_assets/GeoLite2-City.mmdb +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util_assets/arkimeparse.js +0 -0
@@ -4,6 +4,8 @@ import pickle
|
|
4
4
|
import re
|
5
5
|
import traceback
|
6
6
|
|
7
|
+
from requests import session
|
8
|
+
|
7
9
|
from xbase_util.packet_util import filter_visible_chars
|
8
10
|
from xbase_util.pcap_util import reassemble_tcp, reassemble_session
|
9
11
|
|
@@ -30,7 +32,7 @@ if __name__ == '__main__':
|
|
30
32
|
packet_objs = pickle.load(f)
|
31
33
|
skey = f"10.28.7.16:54398"
|
32
34
|
reassemble_tcp_res = reassemble_tcp(packet_objs, skey)
|
33
|
-
all_packets = reassemble_session(reassemble_tcp_res, skey)
|
35
|
+
all_packets = reassemble_session(reassemble_tcp_res, skey,session_id="emm")
|
34
36
|
time_period = [( abs(item['res_time']-item['req_time'])) for item in
|
35
37
|
all_packets if item['res_time'] != 0 and item['req_time'] != 0]
|
36
38
|
print(all_packets)
|
@@ -56,7 +56,7 @@ def decompress_streaming(compressed_data, session_id):
|
|
56
56
|
return bytearray()
|
57
57
|
|
58
58
|
|
59
|
-
def reassemble_tcp(packets,
|
59
|
+
def reassemble_tcp(packets, num_packets=1000):
|
60
60
|
packets2 = []
|
61
61
|
info = {}
|
62
62
|
keys = []
|
@@ -121,7 +121,7 @@ def reassemble_tcp(packets, skey, num_packets=1000):
|
|
121
121
|
return a['tcp']['ack'] - (b['tcp']['seq'] + len(b['tcp']['data']) - 1)
|
122
122
|
|
123
123
|
packets.sort(key=cmp_to_key(compare_packets))
|
124
|
-
del packets[num_packets:]
|
124
|
+
# del packets[num_packets:]
|
125
125
|
# Now divide up conversation
|
126
126
|
clientSeq = 0
|
127
127
|
hostSeq = 0
|
@@ -165,7 +165,7 @@ def reassemble_tcp(packets, skey, num_packets=1000):
|
|
165
165
|
return results
|
166
166
|
|
167
167
|
|
168
|
-
def
|
168
|
+
def parse_req_or_res(data,session_id=None):
|
169
169
|
if data.find(b"\r\n\r\n") != -1:
|
170
170
|
res = data.split(b"\r\n\r\n", 1)
|
171
171
|
header = res[0]
|
@@ -217,6 +217,7 @@ def parse_req_or_res1(data):
|
|
217
217
|
[line.strip() for line in filter_visible_chars(decompressed).splitlines() if
|
218
218
|
line.strip() != ""])
|
219
219
|
except Exception as e:
|
220
|
+
print(f"session_id:{session_id}")
|
220
221
|
traceback.print_exc()
|
221
222
|
result_body_str = filter_visible_chars(result_body)
|
222
223
|
else:
|
@@ -224,7 +225,7 @@ def parse_req_or_res1(data):
|
|
224
225
|
return filter_visible_chars(header), result_body_str
|
225
226
|
|
226
227
|
|
227
|
-
def reassemble_session(reassemble_tcp_res, skey):
|
228
|
+
def reassemble_session(reassemble_tcp_res, skey,session_id=None):
|
228
229
|
my_map = {
|
229
230
|
'key':'',
|
230
231
|
'req_header': '',
|
@@ -238,7 +239,7 @@ def reassemble_session(reassemble_tcp_res, skey):
|
|
238
239
|
}
|
239
240
|
packet_list = []
|
240
241
|
for index, packet in enumerate(reassemble_tcp_res):
|
241
|
-
header, body =
|
242
|
+
header, body = parse_req_or_res(packet['data'],session_id)
|
242
243
|
if index == len(reassemble_tcp_res) - 1:
|
243
244
|
packet_list.append(copy.deepcopy(my_map))
|
244
245
|
if packet['key'] == skey:
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|