SmartDDOSDetection/DatasetGenerator.py at master · jueyaye/SmartDDOSDetection · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
#! /usr/bin/env python
FIN = 0x01
SYN = 0x02
RST = 0x04
PSH = 0x08
ACK = 0x10
URG = 0x20
ECE = 0x40
CWR = 0x80


from scapy.all import *

a = IP(dst="192.166.1.1")/TCP();


def readPCAP(filename):
	packets = rdpcap(filename)
	#for packet in packets:
	#	print packet.haslayer(IP)
	#	if packet.haslayer(IP):
		#	print packet[IP].dst
	return packets


def separateConnectionIPs(packets):
	connections = []
	for packet in packets:
		packet.used = False;

	for packet in packets:


		if (packet.haslayer(IP) and packet.used == False):
			currentPair = [packet[IP].src, packet[IP].dst]
		#	print currentPair

			currentList = []

			for subPacket in packets:
				if subPacket.haslayer(IP):
					if (subPacket[IP].src == currentPair[0] and subPacket[IP].dst == currentPair[1]):
					#	print "SRHEK"
					#	print subPacket;
						subPacket.used = True;
						currentList.append(subPacket);

			connections.append(currentList);

	return connections;


def separateIPsToTCP(IPConnections):
	TCPConnections = []

	for connection in IPConnections:
		for packet in connection:
			packet.used = False;

		if (packet.haslayer(TCP) and packet.used == False):
			currentPair = [packet[TCP].sport, packet[TCP].dport]
		#	print currentPair

			currentList = []

			for subPacket in packets:
				if subPacket.haslayer(TCP):
					if (subPacket[TCP].sport == currentPair[0] and subPacket[TCP].dport == currentPair[1]):

						subPacket.used = True;
						currentList.append(subPacket);

			TCPConnections.append(currentList);


	return TCPConnections;

def separateTCPToUnique(TCPConnection):
	uniqueConnections = []

	for connection in TCPConnection:
		recording = true;

		index = 0;
		uniqueConnections.append([])

		for packet in connection:
			flags = packet['TCP'].flags
			if flags & SYN:
				recording = true;

			if recording == true:
				uniqueConnections[index].append(packet)

			if flags & FIN:
				recording = false
				index += 1


#readPCAP("test.pcap")

print len(separateConnectionIPs(readPCAP("test.pcap")));


print a.dst
print a[TCP].SYN