Python Chained Generators for Network Packets: Read the Docs
Want to see what's happening on your network right now? Just install chains and run 'netwatch'.
$ pip install chains $ netwatch -s 2015-09-07 19:08:34 - UDP IP 192.168.1.9(internal)--> 224.0.0.251(multicast_dns) 2015-09-07 19:08:34 - UDP IP6 fe80::6e40:8ff:fe89:fc08(internal) --> ff02::fb(multicast_dns) 2015-09-07 19:08:34 - UDP IP 192.168.1.14(internal)--> 224.0.0.251(multicast_dns) 2015-09-07 19:08:34 - UDP IP6 fe80::8a0:4946:3c8a:e6a1(internal)--> ff02::fb(multicast_dns) 2015-09-07 19:08:34 - TCP IP 192.168.1.9(internal)--> 49.75.183.151(nxdomain) 2015-09-07 19:08:36 - TCP IP 192.168.1.9(internal)--> 54.164.252.174(compute-1.amazonaws.com) 2015-09-07 19:08:36 - UDP IP 192.168.1.1(internal)--> 192.168.1.9(internal) 2015-09-07 19:08:36 - TCP IP 54.164.252.174(compute-1.amazonaws.com)--> 192.168.1.9(internal) ...
Want to go to coffee shop and see http(s) requests floating about?
$ urlwatch HTTP_REQUEST 192.168.1.9 --> Host: clc.stackoverflow.com URI: /j/p.js?d=hireme&ac=891012&tags=python;attributes&lw=5913&bw=1539 Referer: http://stackoverflow.com/questions/610883/attribute-in-python Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 HTTP_REQUEST 192.168.1.9 --> Host: ajax.googleapis.com URI: /ajax/libs/jquery/1.7.1/jquery.min.js Referer: http://stackoverflow.com/questions/610883/attribute-in-python Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 HTTPS_REQUEST 192.168.1.9 --> 199.166.0.200(sc.iasds01.com) tls_records(5) TLSRecord(length=512, version=769, type=22, data='\x01\x00\x01\xfc\x03\x03K\t\xf8_\x8... TLSRecord(length=262, version=771, type=22, data='\x10\x00\x01\x02\x01\x00Vfd\x8f8a\x... TLSRecord(length=1, version=771, type=20, data='\x01') TLSRecord(length=64, version=771, type=22, data="l\xd0\xce\x96\xf5\x1a\xf8\xcf\xcc\x1... TLSRecord(length=560, version=771, type=23, data='\x1d\x942K\xfb\x87\x19v\xba\x13\x14...
The Chains project is an exploration of python components that you 'chain' together to process streaming network packets. The use of native python generators means the code is extremely lightweight and efficient.
# Create the classes streamer = packet_streamer.PacketStreamer(iface_name=data_path, max_packets=50) meta = packet_meta.PacketMeta() rdns = reverse_dns.ReverseDNS() printer = packet_printer.PacketPrinter() # Set up the chain meta.link(streamer) rdns.link(meta) printer.link(rdns) # Pull the chain printer.pull()
Timestamp: 2015-05-27 01:17:07.919743
Ethernet Frame: 6c:40:08:89:fc:08 --> 01:00:5e:00:00:fb (type: 2048)
Packet: IP 192.168.1.9 --> 224.0.0.251 (len:55 ttl:255) -- Frag(df:0 mf:0 offset:0)
Domains: LOCAL --> multicast_dns
Transport: UDP {'dport': 5353, 'sum': 59346, 'sport': 5353, 'data': '...', 'ulen': 35}
Application: None
Timestamp: 2015-05-27 01:17:07.919926
Ethernet Frame: 6c:40:08:89:fc:08 --> 33:33:00:00:00:fb (type: 34525)
Packet: IP6 fe80::6e40:8ff:fe89:fc08 --> ff02::fb (len:35 ttl:255)
Domains: LOCAL --> multicast_dns
Transport: UDP {'dport': 5353, 'sum': 6703, 'sport': 5353, 'data': '...', 'ulen': 35}
Application: None
...
MIT Licensed