xbase-util 0.7.9__tar.gz → 0.8.1__tar.gz
Sign up to get free protection for your applications and to get access to all the features.
- {xbase_util-0.7.9 → xbase_util-0.8.1}/PKG-INFO +1 -1
- {xbase_util-0.7.9 → xbase_util-0.8.1}/setup.py +1 -1
- {xbase_util-0.7.9 → xbase_util-0.8.1}/test/test.py +3 -1
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/pcap_util.py +6 -5
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util.egg-info/PKG-INFO +1 -1
- {xbase_util-0.7.9 → xbase_util-0.8.1}/README.md +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/setup.cfg +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/__init__.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/add_column_util.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/dangerous_util.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/__init__.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/bean/ConfigBean.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/bean/CurrentConfigBean.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/bean/FlowBean.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/bean/TaskTemplateBean.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/bean/__init__.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/dao/ConfigDao.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/dao/CurrentConfigDao.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/dao/FlowDao.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/dao/TaskTemplateDao.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/dao/__init__.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/db/initsqlite3.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/es_db_util.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/esreq.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/geo_util.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/handle_features_util.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/packet_util.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/xbase_constant.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util/xbase_util.py +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util.egg-info/SOURCES.txt +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util.egg-info/dependency_links.txt +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util.egg-info/not-zip-safe +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util.egg-info/top_level.txt +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util_assets/GeoLite2-City.mmdb +0 -0
- {xbase_util-0.7.9 → xbase_util-0.8.1}/xbase_util_assets/arkimeparse.js +0 -0
@@ -4,6 +4,8 @@ import pickle
|
|
4
4
|
import re
|
5
5
|
import traceback
|
6
6
|
|
7
|
+
from requests import session
|
8
|
+
|
7
9
|
from xbase_util.packet_util import filter_visible_chars
|
8
10
|
from xbase_util.pcap_util import reassemble_tcp, reassemble_session
|
9
11
|
|
@@ -30,7 +32,7 @@ if __name__ == '__main__':
|
|
30
32
|
packet_objs = pickle.load(f)
|
31
33
|
skey = f"10.28.7.16:54398"
|
32
34
|
reassemble_tcp_res = reassemble_tcp(packet_objs, skey)
|
33
|
-
all_packets = reassemble_session(reassemble_tcp_res, skey)
|
35
|
+
all_packets = reassemble_session(reassemble_tcp_res, skey,session_id="emm")
|
34
36
|
time_period = [( abs(item['res_time']-item['req_time'])) for item in
|
35
37
|
all_packets if item['res_time'] != 0 and item['req_time'] != 0]
|
36
38
|
print(all_packets)
|
@@ -56,7 +56,7 @@ def decompress_streaming(compressed_data, session_id):
|
|
56
56
|
return bytearray()
|
57
57
|
|
58
58
|
|
59
|
-
def reassemble_tcp(packets,
|
59
|
+
def reassemble_tcp(packets, num_packets=1000):
|
60
60
|
packets2 = []
|
61
61
|
info = {}
|
62
62
|
keys = []
|
@@ -121,7 +121,7 @@ def reassemble_tcp(packets, skey, num_packets=1000):
|
|
121
121
|
return a['tcp']['ack'] - (b['tcp']['seq'] + len(b['tcp']['data']) - 1)
|
122
122
|
|
123
123
|
packets.sort(key=cmp_to_key(compare_packets))
|
124
|
-
del packets[num_packets:]
|
124
|
+
# del packets[num_packets:]
|
125
125
|
# Now divide up conversation
|
126
126
|
clientSeq = 0
|
127
127
|
hostSeq = 0
|
@@ -165,7 +165,7 @@ def reassemble_tcp(packets, skey, num_packets=1000):
|
|
165
165
|
return results
|
166
166
|
|
167
167
|
|
168
|
-
def
|
168
|
+
def parse_req_or_res(data,session_id=None):
|
169
169
|
if data.find(b"\r\n\r\n") != -1:
|
170
170
|
res = data.split(b"\r\n\r\n", 1)
|
171
171
|
header = res[0]
|
@@ -217,6 +217,7 @@ def parse_req_or_res1(data):
|
|
217
217
|
[line.strip() for line in filter_visible_chars(decompressed).splitlines() if
|
218
218
|
line.strip() != ""])
|
219
219
|
except Exception as e:
|
220
|
+
print(f"session_id:{session_id}")
|
220
221
|
traceback.print_exc()
|
221
222
|
result_body_str = filter_visible_chars(result_body)
|
222
223
|
else:
|
@@ -224,7 +225,7 @@ def parse_req_or_res1(data):
|
|
224
225
|
return filter_visible_chars(header), result_body_str
|
225
226
|
|
226
227
|
|
227
|
-
def reassemble_session(reassemble_tcp_res, skey):
|
228
|
+
def reassemble_session(reassemble_tcp_res, skey,session_id=None):
|
228
229
|
my_map = {
|
229
230
|
'key':'',
|
230
231
|
'req_header': '',
|
@@ -238,7 +239,7 @@ def reassemble_session(reassemble_tcp_res, skey):
|
|
238
239
|
}
|
239
240
|
packet_list = []
|
240
241
|
for index, packet in enumerate(reassemble_tcp_res):
|
241
|
-
header, body =
|
242
|
+
header, body = parse_req_or_res(packet['data'],session_id)
|
242
243
|
if index == len(reassemble_tcp_res) - 1:
|
243
244
|
packet_list.append(copy.deepcopy(my_map))
|
244
245
|
if packet['key'] == skey:
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|