Giter Club home page Giter Club logo

pcap.jl's Introduction

Pcap Build Status

Pcap contains libpcap bindings for Julia as well as logic to parse and extract useful data from packet captures

Example

using Pcap

function display_eth_hdr(ethhdr::EthHdr)
    println("Ethernet Header")
    println("  |- Src Mac  : $(ethhdr.src_mac)")
    println("  |- Dest Mac : $(ethhdr.dest_mac)")
    println("  |- Type     : $(ethhdr.ptype)")
end # function display_ip_hdr

function display_ip_hdr(iphdr::IpHdr)
    println("IP Header")
    println("  |- Version         : $(iphdr.version)")
    println("  |- Length          : $(iphdr.length)")
    println("  |- Type of Service : $(iphdr.services)")
    println("  |- Total Length    : $(iphdr.totlen)")
    println("  |- ID              : $(iphdr.id)")
    println("  |- TTL             : $(iphdr.ttl)")
    println("  |- Protocol        : $(iphdr.protocol)")
    println("  |- Src Ip          : $(iphdr.src_ip)")
    println("  |- Dest Ip         : $(iphdr.dest_ip)")
    println("  |- Checksum        : $(iphdr.checksum)")
end # function display_ip_hdr

function display_udp_hdr(udphdr::UdpHdr)
    println("UDP Header")
    println("  |- Src Port  : $(udphdr.src_port)")
    println("  |- Dest Port : $(udphdr.dest_port)")
    println("  |- Length    : $(udphdr.length)")
    println("  |- Checksum  : 0x$(string(udphdr.checksum, base=16, pad=4))")
    print("  |- Data : ")

    n = 0
    for byte = udphdr.data
        if n % 16 == 0 && n != 0
            print("\n            ")
        end
        print("$(string(byte, base=16, pad=2)) ")
        n = n + 1
    end
end # function display_udp_hdr

cap     = PcapOffline("data/dns-query-response.pcap")
rec     = pcap_get_record(cap)
layers  = decode_pkt(rec.payload)

println("---------- UDP Packet ----------\n")
display_eth_hdr(layers.datalink)
display_ip_hdr(layers.network)
if (layers.network.protocol == 17)
    display_udp_hdr(layers.protocol)
end
println("\n\n--------------------------------\n")

Output

---------- UDP Packet ----------

Ethernet Header
  |- Src Mac  : 74:de:2b:08:78:09
  |- Dest Mac : 00:24:fe:b1:8f:dc
  |- Type     : 2048
IP Header
  |- Version         : 4
  |- Length          : 20
  |- Type of Service : 0
  |- Total Length    : 63
  |- ID              : 20831
  |- TTL             : 64
  |- Protocol        : 17
  |- Src Ip          : 192.168.0.51
  |- Dest Ip         : 192.168.0.1
  |- Checksum        : true
UDP Header
  |- Src Port  : 34904
  |- Dest Port : 53
  |- Length    : 43
  |- Checksum  : 0xa24a
  |- Data : 56 6d 01 00 00 01 00 00 00 00 00 00 0d 66 65 64
            6f 72 61 70 72 6f 6a 65 63 74 03 6f 72 67 00 00
            01 00 01

--------------------------------

pcap.jl's People

Contributors

ki-chi avatar asinghvi17 avatar yuyichao avatar zak21rs avatar

Stargazers

anand jain avatar jabelic avatar Four avatar Agustín Covarrubias avatar Soju Yamashita avatar Mauro Risonho de Paula Assumpção avatar 竹林草屋 avatar STYLIANOS IORDANIS avatar Ben Baumgold avatar Kestutis Vinciunas avatar Casey Kneale avatar Gábor Nagymajtényi avatar Julian Samaroo avatar  avatar Andrey Ferriyan avatar Gaetano Carlucci avatar  avatar Zeysh avatar Luis Belloch avatar Stefan Karpinski avatar

Watchers

James Cloos avatar  avatar  avatar  avatar

pcap.jl's Issues

Julia 1.0 Support

Looks like multiple pieces broke with the 1.0 Julia release.

I was able to get the package to load by replacing "type" with "struct" and by updating @inline functions "function f{T}(x::T), has been changed to function f(x::T) where {T}"

But now I am stuck when I try to read a pcap with PcapOffline
Pcap.zip

Thanks

Info about upcoming removal of packages in the General registry

As described in https://discourse.julialang.org/t/ann-plans-for-removing-packages-that-do-not-yet-support-1-0-from-the-general-registry/ we are planning on removing packages that do not support 1.0 from the General registry. This package has been detected to not support 1.0 and is thus slated to be removed. The removal of packages from the registry will happen approximately a month after this issue is open.

To transition to the new Pkg system using Project.toml, see https://github.com/JuliaRegistries/Registrator.jl#transitioning-from-require-to-projecttoml.
To then tag a new version of the package, see https://github.com/JuliaRegistries/Registrator.jl#via-the-github-app.

If you believe this package has erroneously been detected as not supporting 1.0 or have any other questions, don't hesitate to discuss it here or in the thread linked at the top of this post.

Restrict version to Julia 0.4 prerelease?

It seems like this packages doesn't work on 0.3. It should really have a REQUIRES file that says that, i.e.

julia 0.4-

and the METADATA entry for the first tagged version should have a requires added to indicate it doesn't work.

Pcap file endianness not handled

I recorded packets on a big-endian machine and tried reading them with Pcap.jl on a little-endian one:

julia> using Pcap

julia> cap = PcapOffline("big-endian-icmp-echo-request.pcap")
Pcap.PcapOffline("big-endian-icmp-echo-request.pcap",IOStream(<file big-endian-icmp-echo-request.pcap>),Pcap.PcapFileHeader(0x00000000,0x0000,0x0000,0,0x00000000,0x00000000,0x00000000),Pcap.PcapRec(0x00000000,0x00000000,0x00000000,0x00000000,UInt8[]),false)

julia> rec = pcap_get_record(cap)
Pcap.PcapRec(0xb0589556,0x104d0d00,0x62000000,0x62000000,UInt8[0xf8,0x1a,0x67,0x49,0x9f,0x9c,0x28,0xd2,0x44,0x46  …  0x2e,0x2f,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37])

julia> cap.filehdr.version_major
0x0200

julia> rec.incl_len
0x62000000

pcap_get_header and pcap_get_record probably should use the magic number. Note that tcpdump can write 0xa1b2c3d4 (same-endian), 0xd4c3b2a1 (other-endian), 0xa1b23c4d (same-endian, nanosecond timestamps) and 0x4d3cb2a1 (other-endian, nanosecond timestamps).

Attaching an example big-endian capture.

Julia 1.0.1 Compatibility

Hello, will there be any update in Julia Pcap package? Currently this package is not available to install on Julia V1.0.1.

Thanks.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.