detector.py
319aed357fc9master

detector.py
View Options

			import sys
			import dpkt
			import socket


			def main(argv):

			f = open(argv[0])
			pcap = dpkt.pcap.Reader(f)

			sent_syn={}
			received_syn_ack={}

			for ts, buf in pcap:

			#throw away malformed
			eth = dpkt.ethernet.Ethernet(buf)
			if eth.data:
			ip = eth.data
			if ip.data:
			tcp = ip.data

			#check if syn packet or syn_ack
			# add ips to lists
			#syn_flag
			if ( tcp.flags & dpkt.tcp.TH_SYN ) != 0:
			#syn ack flag
			if ( tcp.flags & dpkt.tcp.TH_ACK ) != 0:
			ip_addr=socket.inet_ntoa(ip.dst)
			received_syn_ack[ip_addr]= received_syn_ack.get(ip_addr,d=0)+1
			else:
			ip_addr=socket.inet_ntoa(ip.src)
			sent_syn[ip_addr]= sent_syn.get(ip_addr,d=0)+1

			#comparing
			suspisious_ips=[]
			for ip_addr, syn_count in sent_syn.items():
			syn_ack_count=received_syn_ack.get(ip_addr,d=0)
			if syn_count>3*syn_ack_count:
			suspisious_ips.append(ip_addr)

			print (suspisious_ips)


			if __name__ == "__main__":
			main(sys.argv[1:])