pdml2flow 5.3

先决条件

• python：
• 3.4
• 3.5
• 3.5-开发
• 3.6
• 3.6-开发
• 3.7-开发
• 每晚
• pip

安装

$ sudo pip install pdml2flow

用法

$ pdml2flow -h
usage: pdml2flow [-h][--version][-f FLOW_DEF_STR][-t FLOW_BUFFER_TIME][-l DATA_MAXLEN][-c][-a][-s][-d][+json [args]][+xml [args]]

Aggregates wireshark pdml to flows

optional arguments:
  -h, --help           show this help message and exit
  --version            Print version and exit
  -f FLOW_DEF_STR      Fields which define the flow, nesting with: '.'[default: ['vlan.id', 'ip.src', 'ip.dst', 'ipv6.src',
                       'ipv6.dst', 'udp.stream', 'tcp.stream']]
  -t FLOW_BUFFER_TIME  Lenght (in seconds) to buffer a flow before writing the
                       packets [default: 180]
  -l DATA_MAXLEN       Maximum lenght of data in tshark pdml-field [default:
                       200]
  -c                   Removes duplicate data when merging objects, will not
                       preserve order of leaves [default: False]
  -a                   Instead of merging the frames will append them to an
                       array [default: False]
  -s                   Extract show names, every data leaf will now look like
                       { raw : [] , show: []}[default: False]
  -d                   Debug mode [default: False]

Plugins:
  +json [args]         usage: JSON output [-h][-0] optional arguments: -h,
                       --help show this help message and exit -0 Terminates
                       lines with null character
  +xml [args]          usage: XML output [-h][-0] optional arguments: -h,
                       --help show this help message and exit -0 Terminates
                       lines with null character

示例

从接口嗅探并编写json:

$ tshark -i interface -Tpdml | pdml2flow +json

读取.pcap文件

$ tshark -r pcap_file -Tpdml | pdml2flow +json

基于以太网源和以太网目标地址的聚合

$ tshark -i interface -Tpdml | pdml2flow -f eth.src -f eth.dst +json

使用jq

$ tshark -i interface -Tpdml | pdml2flow +json | jq

后处理流程使用 FluentFlow

$ tshark -i interface -Tpdml | pdml2flow +json | fluentflow rules.js

插件

• elasticsearch： 将pdml2flow输出保存在elasticsearch中
• base64-strings： 提取以base64编码的字符串
• frame-inter-arrival-time： 计算帧间到达时间
• pdml2flow/plugins/：插件由 默认值

# vim: set fenc=utf8 ts=4 sw=4 et :classPlugin2(object):# pragma: no cover"""Version 2 plugin interface."""@staticmethoddefhelp():"""Return a help string."""passdef__init__(self,*args):"""Called once during startup."""passdef__deinit__(self):"""Called once during shutdown."""passdefflow_new(self,flow,frame):"""Called every time a new flow is opened."""passdefflow_expired(self,flow):"""Called every time a flow expired, before printing the flow."""passdefflow_end(self,flow):"""Called every time a flow ends, before printing the flow."""passdefframe_new(self,frame,flow):"""Called for every new frame."""pass

实用程序

以下实用程序是本项目的一部分

$ pdml2frame -h
usage: pdml2frame [-h][--version][-s][-d][+json [args]][+xml [args]]

Converts wireshark pdml to frames

optional arguments:
  -h, --help    show this help message and exit
  --version     Print version and exit
  -s            Extract show names, every data leaf will now look like { raw :
                [] , show: []}[default: False]
  -d            Debug mode [default: False]

Plugins:
  +json [args]  usage: JSON output [-h][-0] optional arguments: -h, --help
                show this help message and exit -0 Terminates lines with null
                character
  +xml [args]   usage: XML output [-h][-0] optional arguments: -h, --help
                show this help message and exit -0 Terminates lines with null
                character

测试

• Test documentation

运行测试：

$ python setup.py test