#!/usr/bin/env python # encoding: utf-8 """ Capture.py Created by Cody Brocious on 2007-04-07. Copyright (c) 2006 Cody Brocious All rights reserved. """ import sys, struct, pcapy, impacket, impacket.ImpactDecoder PORT = 2900 class Packet: def __init__(self, src, dest, packet): self.src = src self.dest = dest self.packet = packet self.decode(packet) def decode(self, packet): header, data = packet[0:16], packet[16:] plen = struct.unpack('C', else: print 'C->S', print '%08X - ' % len(data) + ''.join(['%02X ' % ord(c) for c in header[:8]]) + ' ' + ''.join(['%02X ' % ord(c) for c in header[8:]]) def __str__(self): ret = '%r -> %r\n' % (self.src, self.dest) for i in range(0, len(self.packet), 16): ret += '%08X ' % i for j in range(16): if j == 8: ret += ' ' if i+j >= len(self.packet): ret += ' ' else: ret += '%02X ' % ord(self.packet[i+j]) ret += ' | ' for j in range(16): if j == 8: ret += ' ' if i+j >= len(self.packet): ret += ' ' else: c = self.packet[i+j] if c.lower() in 'abcdefghijklmnopqrstuvwxyz0123456789`~!@#$%^&*()_+=-[]{}\\|<>?,./': ret += c else: ret += '.' ret += '\n' ret += '%08X\n' % len(self.packet) return ret class Capture: def __init__(self, args): # self.reader = pcapy.open_offline(args[0]) self.reader = pcapy.open_live(args[0], 65536, True, 100) self.decoder = impacket.ImpactDecoder.EthDecoder() while True: try: header, data = self.reader.next() except: continue eth = self.decoder.decode(data) ip = eth.child() if ip.__class__ != impacket.ImpactPacket.IP: continue sip = ip.get_ip_src() dip = ip.get_ip_dst() child = ip.child() if child.__class__ == impacket.ImpactPacket.UDP: self.handleUDP(sip, dip, child) def handleUDP(self, sip, dip, child): sport = child.get_uh_sport() dport = child.get_uh_dport() packet = child.get_data_as_string() if sport != PORT and dport != PORT: return packet = Packet((sip, sport), (dip, dport), packet) print packet if __name__=='__main__': Capture(sys.argv[1:])