mirror of
git://git.acid.vegas/random.git
synced 2024-11-14 12:06:38 +00:00
52 lines
1.8 KiB
Python
52 lines
1.8 KiB
Python
#!/usr/bin/env python
|
|
# DDoSmon - developed by acidvegas in python (https://git.acid.vegas/ddosmon)
|
|
import socket
|
|
|
|
try:
|
|
import dpkt
|
|
from dpkt.compat import compat_ord
|
|
except ImportError:
|
|
raise Exception('missing required \'dpkt\' library (pip install dpkt)')
|
|
|
|
try:
|
|
import pcapy
|
|
except ImportError:
|
|
raise Exception('missing required \'pcapy\' library (pip install pcapy)')
|
|
|
|
def inet_to_str(inet):
|
|
try:
|
|
return socket.inet_ntop(socket.AF_INET, inet)
|
|
except ValueError:
|
|
return socket.inet_ntop(socket.AF_INET6, inet)
|
|
|
|
def mac_addr(address):
|
|
return ':'.join('%02x' % compat_ord(b) for b in address)
|
|
|
|
def handle_packet(header, data):
|
|
eth = dpkt.ethernet.Ethernet(data)
|
|
if isinstance(eth.data, dpkt.ip.IP) or isinstance(eth.data, dpkt.ip6.IP6):
|
|
ip = eth.data
|
|
do_not_fragment = bool(ip.off & dpkt.ip.IP_DF)
|
|
more_fragments = bool(ip.off & dpkt.ip.IP_MF)
|
|
fragment_offset = ip.off & dpkt.ip.IP_OFFMASK
|
|
print('Protocol : ', ip.get_proto(ip.p).__name__)
|
|
print('Ethernet Frame : ', mac_addr(eth.src), mac_addr(eth.dst), eth.type)
|
|
print('Connection : %s:%s -> %s:%s (len=%d ttl=%d DF=%d MF=%d offset=%d)' % (inet_to_str(ip.src), ip.data.sport, inet_to_str(ip.dst), ip.data.dport, ip.len, ip.ttl, do_not_fragment, more_fragments, fragment_offset))
|
|
if isinstance(ip.data, dpkt.icmp.ICMP):
|
|
icmp = ip.data
|
|
print('ICMP: type:%d code:%d checksum:%d data: %s\n' % (icmp.type, icmp.code, icmp.sum, repr(icmp.data)))
|
|
elif isinstance(ip.data, dpkt.tcp.TCP):
|
|
tcp = ip.data
|
|
try:
|
|
request = dpkt.http.Request(tcp.data)
|
|
except (dpkt.dpkt.NeedData, dpkt.dpkt.UnpackError):
|
|
pass
|
|
else:
|
|
print('HTTP request: %s\n' % repr(request))
|
|
if not tcp.data.endswith(b'\r\n'):
|
|
print('\nHEADER TRUNCATED! Reassemble TCP segments!\n')
|
|
|
|
if __name__ == '__main__':
|
|
pcap = pcapy.open_live('eth0', 65536, 0, 100)
|
|
pcap.loop(-1, handle_packet)
|