o jt@sddlmZddlmZddlZddlZddlmZddlmZddlm Z m Z GdddZ Gd d d Z d d Z ed kraeejeejdkrXedejdede ejddSdS))division)print_functionN) open_offline)version) EthDecoderLinuxSLLDecoderc@s0eZdZdZddZddZddZdd Zd S) ConnectionzThis class can be used as a key in a dictionary to select a connection given a pair of peers. Two connections are considered the same if both peers are equal, despite the order in which they were passed to the class constructor. cCs||_||_dS)zThis constructor takes two tuples, one for each peer. The first element in each tuple is the IP address as a string, and the second is the port as an integer. Np1p2)selfr r r /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/split.py__init__,s zConnection.__init__cCs(d|jd|jd|jd|jdfS)zoUtility function that returns a filename composed by the IP addresses and ports of both peers. z%s.%d-%s.%d.pcaprr r r r r getFilename5s(zConnection.getFilenamecCs8|j|jkr |j|jks|j|jkr|j|jkrdSdS)Nrr )r otherr r r__cmp__;szConnection.__cmp__cCs8t|jdt|jdAt|jdAt|jdAS)Nrr)hashr r rr r r__hash__Bs   zConnection.__hash__N)__name__ __module__ __qualname____doc__rrrrr r r rr%s   rc@s$eZdZddZddZddZdS)DecodercCsL|}tj|krt|_ntj|krt|_ntd|||_i|_ dS)NzDatalink type not supported: ) datalinkpcapy DLT_EN10MBrdecoder DLT_LINUX_SLLr Exceptionpcap connections)r pcapObjrr r rrHs      zDecoder.__init__cCs|jd|jdS)Nr)r#loop packetHandlerrr r rstartUsz Decoder.startc Cs|j|}|}|}||f}||f}t||}d|j|j f|j vr[| } t d| z|j | } WntjyOt d| YdSw| |j d|j|j f<|j d|j|j f||dS)aHandles an incoming pcap packet. This method only knows how to recognize TCP/IP connections. Be sure that only TCP packets are passed onto this handler (or fix the code to ignore the others). Setting r"ip proto cp" as part of the pcap filter expression suffices, and there shouldn't be any problem combining that with other expressions. z%s%sz%Found a new connection, storing into:zCan't write packet to:N)r decodechild get_ip_src get_th_sport get_ip_dst get_th_dportrr r r$rprintr# dump_openr PcapErrordump) r hdrdatapiptcpsrcdstconfndumperr r rr'Zs"    "zDecoder.packetHandlerN)rrrrr(r'r r r rrGs rcCs6t|}|dtd||ft|dS)Nz ip proto \tcpzReading from %s: linktype=%d)r setfilterr/rrr()filenamer5r r rmains r?__main__rzUsage: %s ) __future__rrsysrrimpacketrimpacket.ImpactDecoderrrrrr?rr/DEPRECATION_WARNING_BANNERlenargvexitr r r rs"    ":