xbase-util 0.8.9__tar.gz → 0.9.0__tar.gz
Sign up to get free protection for your applications and to get access to all the features.
- {xbase_util-0.8.9 → xbase_util-0.9.0}/PKG-INFO +1 -1
- {xbase_util-0.8.9 → xbase_util-0.9.0}/setup.py +1 -1
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/common_util.py +4 -2
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/pcap_util.py +1 -3
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/test.py +1 -3
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util.egg-info/PKG-INFO +1 -1
- {xbase_util-0.8.9 → xbase_util-0.9.0}/README.md +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/setup.cfg +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/__init__.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/add_column_util.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/dangerous_util.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/__init__.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/bean/ConfigBean.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/bean/CurrentConfigBean.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/bean/FlowBean.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/bean/TaskTemplateBean.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/bean/__init__.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/dao/ConfigDao.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/dao/CurrentConfigDao.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/dao/FlowDao.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/dao/TaskTemplateDao.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/dao/__init__.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/initsqlite3.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/es_db_util.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/esreq.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/geo_util.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/handle_features_util.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/packet_util.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/xbase_constant.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util.egg-info/SOURCES.txt +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util.egg-info/dependency_links.txt +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util.egg-info/not-zip-safe +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util.egg-info/top_level.txt +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util_assets/GeoLite2-City.mmdb +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util_assets/arkimeparse.js +0 -0
@@ -3,6 +3,7 @@ import json
|
|
3
3
|
import logging
|
4
4
|
import os
|
5
5
|
import re
|
6
|
+
import traceback
|
6
7
|
from collections import Counter
|
7
8
|
from datetime import datetime
|
8
9
|
from logging.handlers import TimedRotatingFileHandler
|
@@ -44,12 +45,13 @@ def parse_chunked_body(data: bytes, need_un_gzip=False,session_id="none") -> byt
|
|
44
45
|
try:
|
45
46
|
return gzip.decompress(body)
|
46
47
|
except gzip.BadGzipFile:
|
47
|
-
print("
|
48
|
+
print(f"解压错误:{session_id}")
|
48
49
|
return body
|
49
50
|
else:
|
50
51
|
return body
|
51
52
|
except Exception as e:
|
52
|
-
|
53
|
+
traceback.print_exc()
|
54
|
+
print(f"其他错误:session:{session_id}")
|
53
55
|
return b''
|
54
56
|
|
55
57
|
|
@@ -291,7 +291,7 @@ def parse_body(data,session_id='none'):
|
|
291
291
|
try:
|
292
292
|
body = gzip.decompress(body)
|
293
293
|
except:
|
294
|
-
print("
|
294
|
+
print(f"解压失败:{session_id}")
|
295
295
|
pass
|
296
296
|
result_body_str = filter_visible_chars(body)
|
297
297
|
return filter_visible_chars(header), result_body_str
|
@@ -300,10 +300,8 @@ def parse_body(data,session_id='none'):
|
|
300
300
|
def reassemble_session_pcap(reassemble_tcp_res, skey, session_id='none'):
|
301
301
|
my_map = None # 初始化为 None
|
302
302
|
packet_list = []
|
303
|
-
|
304
303
|
for packet in reassemble_tcp_res:
|
305
304
|
header, body = parse_body(packet['data'], session_id=session_id)
|
306
|
-
|
307
305
|
# 如果当前数据包是请求
|
308
306
|
if packet['key'] == skey:
|
309
307
|
# 如果 my_map 已经存在(即已经有一个未完成的请求-响应对),先将其添加到 packet_list
|
@@ -1,11 +1,9 @@
|
|
1
|
-
from scapy.packet import Raw
|
2
1
|
from scapy.utils import rdpcap
|
3
2
|
|
4
3
|
from xbase_util.pcap_util import reassemble_tcp_pcap, reassemble_session_pcap
|
5
4
|
|
6
5
|
if __name__ == '__main__':
|
7
6
|
packets_scapy = reassemble_tcp_pcap(rdpcap("test.pcap"))
|
8
|
-
skey = '10.28.7.
|
7
|
+
skey = '10.28.7.13:52631'
|
9
8
|
all_packets = reassemble_session_pcap(packets_scapy, skey=skey,session_id='enn')
|
10
|
-
|
11
9
|
print(all_packets)
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|