使用kamene對pcap包進行解析

2021-09-26 08:58:13 字數 3096 閱讀 9654

pip install kamene即可,但由於本機(win7環境)無法正常使用kamene,只好切換到linux環境下。

import os

import gzip

import shutil

from difflib import sequencematcher

root_dir = r'/home/report/data'

file_name = os.listdir(root_dir)

# 對檔名進行聚類

file_name_dict = {}

cls_name_set = set()

for find_name in file_name:

if find_name in cls_name_set:

continue

file_name_dict[find_name] = [find_name]

cls_name_set.add(find_name)

for match_name in file_name:

if match_name in cls_name_set:

continue

if sequencematcher(none, find_name, match_name).ratio() > 0.97:

cls_name_set.add(match_name)

# 對檔案進行壓縮

for key, file_name_list in file_name_dict.items():

folder_path = os.path.join(root_dir, '.'.join(key.split('.')[:-2:]))

os.mkdir(folder_path)

for name in file_name_list:

with gzip.open(os.path.join(root_dir, name), 'rb') as f_in:

with open(os.path.join(folder_path, '.'.join(name.split('.')[:-1:])), 'wb') as f_out:

shutil.copyfileobj(f_in, f_out)

刪除gz檔案

os.system('rm -rf /home/report/data/*.gz')
from kamene.all import *

def longestcommonprefix(self):

l = zip(*strs)

# list(zip(*["abc","efg","jk"])) --例子輸出-→ [('a', 'e', 'j'), ('b', 'f', 'k')] # 加*表示反向zip()

r = [len(set(c)) == 1 for c in l] + [false]

# set([1,1,0,1]) --例子輸出-→ [1,0] # set()刪除重複元素

if strs != :

s = r.index(false) # 查詢第乙個false的下標

return strs[0][0:s] # 列表查詢+切片

else:

return ''

from kamene.all import *

def longestcommonprefix(strs):

l = zip(*strs)

r = [len(set(c)) == 1 for c in l] + [false]

if strs != :

s = r.index(false)

return strs[0][0:s]

else:

return ''

def get_tcp_feature(dir_path):

group_data = {}

for file_name in os.listdir(dir_path):

whole_file_path = os.path.join(dir_path, file_name)

with pcapreader(whole_file_path) as pcap_reader:

for index, pkt in enumerate(pcap_reader):

if 'tcp' in pkt:

if pkt.haslayer('raw'): #讀取應用層資料

hex_data = bytes(pkt['raw'])

str_data = str(hex_data)

if group_data.get(index, -1) == -1:

group_data[index] = [str_data]

else:

for str_data in group_data.values():

if len(str_data) == 3:

feature = longestcommonprefix(str_data)

print(feature)

break

#得到特徵

for root, dir, file in os.walk('/home/report/data'):

if len(dir) == 0:

break

for folder in dir:

get_tcp_feature(os.path.join(root, folder))

group_data = 

with pcapreader('3s_smart_software_solutions_codesys_gateway_server_packet_size_denial_of_service_cve-2012-47071.pcap') as pcap_reader:

for index, pkt in enumerate(pcap_reader):

if 'tcp' in pkt:

if pkt.haslayer('raw'): #讀取應用層資料

hex_data = bytes(pkt['raw'])

android使用tinker對app進行熱修復

專案裡包含了lib的原始碼和sample,下下來,然後開啟tinker sample android 修改mainactivity中textview android id id textview android layout width wrap content android layout hei...

使用Fiddler對Android應用進行抓包

1.開啟fiddler軟體,效果圖如下 2.首先,確保安裝 fiddler 的電腦和你的手機在同一區域網內,因為fiddler只是乙個 需要將手機的 指向 pc 機,不能互相訪問是不行的。如果你的pc沒有無線網絡卡,看文章最後 3.開啟fiddler的遠端連線,fiddler 主選單 tools f...

使用TortoiseGit對Git版本進行分支操作

版本轉殖分支問題 tortoisegit在轉殖分支的時候,預設轉殖master分支,轉殖後本地工作目錄為中心器的master分支.轉殖後本地分支 中心庫分支 push分支到中心伺服器 pushing the local branch to a new remote branch git在本地建立分支...