xbase-util 0.8.9__tar.gz → 0.9.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {xbase_util-0.8.9 → xbase_util-0.9.0}/PKG-INFO +1 -1
- {xbase_util-0.8.9 → xbase_util-0.9.0}/setup.py +1 -1
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/common_util.py +4 -2
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/pcap_util.py +1 -3
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/test.py +1 -3
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util.egg-info/PKG-INFO +1 -1
- {xbase_util-0.8.9 → xbase_util-0.9.0}/README.md +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/setup.cfg +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/__init__.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/add_column_util.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/dangerous_util.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/__init__.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/bean/ConfigBean.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/bean/CurrentConfigBean.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/bean/FlowBean.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/bean/TaskTemplateBean.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/bean/__init__.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/dao/ConfigDao.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/dao/CurrentConfigDao.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/dao/FlowDao.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/dao/TaskTemplateDao.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/dao/__init__.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/db/initsqlite3.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/es_db_util.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/esreq.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/geo_util.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/handle_features_util.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/packet_util.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util/xbase_constant.py +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util.egg-info/SOURCES.txt +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util.egg-info/dependency_links.txt +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util.egg-info/not-zip-safe +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util.egg-info/top_level.txt +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util_assets/GeoLite2-City.mmdb +0 -0
- {xbase_util-0.8.9 → xbase_util-0.9.0}/xbase_util_assets/arkimeparse.js +0 -0
@@ -3,6 +3,7 @@ import json
|
|
3
3
|
import logging
|
4
4
|
import os
|
5
5
|
import re
|
6
|
+
import traceback
|
6
7
|
from collections import Counter
|
7
8
|
from datetime import datetime
|
8
9
|
from logging.handlers import TimedRotatingFileHandler
|
@@ -44,12 +45,13 @@ def parse_chunked_body(data: bytes, need_un_gzip=False,session_id="none") -> byt
|
|
44
45
|
try:
|
45
46
|
return gzip.decompress(body)
|
46
47
|
except gzip.BadGzipFile:
|
47
|
-
print("
|
48
|
+
print(f"解压错误:{session_id}")
|
48
49
|
return body
|
49
50
|
else:
|
50
51
|
return body
|
51
52
|
except Exception as e:
|
52
|
-
|
53
|
+
traceback.print_exc()
|
54
|
+
print(f"其他错误:session:{session_id}")
|
53
55
|
return b''
|
54
56
|
|
55
57
|
|
@@ -291,7 +291,7 @@ def parse_body(data,session_id='none'):
|
|
291
291
|
try:
|
292
292
|
body = gzip.decompress(body)
|
293
293
|
except:
|
294
|
-
print("
|
294
|
+
print(f"解压失败:{session_id}")
|
295
295
|
pass
|
296
296
|
result_body_str = filter_visible_chars(body)
|
297
297
|
return filter_visible_chars(header), result_body_str
|
@@ -300,10 +300,8 @@ def parse_body(data,session_id='none'):
|
|
300
300
|
def reassemble_session_pcap(reassemble_tcp_res, skey, session_id='none'):
|
301
301
|
my_map = None # 初始化为 None
|
302
302
|
packet_list = []
|
303
|
-
|
304
303
|
for packet in reassemble_tcp_res:
|
305
304
|
header, body = parse_body(packet['data'], session_id=session_id)
|
306
|
-
|
307
305
|
# 如果当前数据包是请求
|
308
306
|
if packet['key'] == skey:
|
309
307
|
# 如果 my_map 已经存在(即已经有一个未完成的请求-响应对),先将其添加到 packet_list
|
@@ -1,11 +1,9 @@
|
|
1
|
-
from scapy.packet import Raw
|
2
1
|
from scapy.utils import rdpcap
|
3
2
|
|
4
3
|
from xbase_util.pcap_util import reassemble_tcp_pcap, reassemble_session_pcap
|
5
4
|
|
6
5
|
if __name__ == '__main__':
|
7
6
|
packets_scapy = reassemble_tcp_pcap(rdpcap("test.pcap"))
|
8
|
-
skey = '10.28.7.
|
7
|
+
skey = '10.28.7.13:52631'
|
9
8
|
all_packets = reassemble_session_pcap(packets_scapy, skey=skey,session_id='enn')
|
10
|
-
|
11
9
|
print(all_packets)
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|