16
16
17
17
import chepy .core
18
18
19
+ logging .getLogger ("scapy" ).setLevel (logging .ERROR )
20
+
19
21
20
22
def _full_duplex (p ): # pragma: no cover
21
23
"""Create a full duplex stream from packets
@@ -295,8 +297,8 @@ class PcapUSB:
295
297
296
298
297
299
class Pcap (chepy .core .ChepyCore ):
298
- """This plugin allows handling of various pcap
299
- related operations.
300
+ """This plugin allows handling of various pcap
301
+ related operations.
300
302
301
303
scapy is a requirement for this plugin.
302
304
"""
@@ -316,9 +318,9 @@ def _pcap_reader_instance(self, bpf_filter):
316
318
@chepy .core .ChepyDecorators .call_stack
317
319
def read_pcap (self ):
318
320
"""Load a pcap. The state is set to scapy
319
-
321
+
320
322
Returns:
321
- ChepyPlugin: The Chepy object.
323
+ ChepyPlugin: The Chepy object.
322
324
"""
323
325
self ._pcap_filepath = str (self ._abs_path (self .state ))
324
326
self .state = "Pcap loaded"
@@ -327,9 +329,9 @@ def read_pcap(self):
327
329
@chepy .core .ChepyDecorators .call_stack
328
330
def pcap_dns_queries (self ):
329
331
"""Get DNS queries and their frame numbers
330
-
332
+
331
333
Returns:
332
- ChepyPlugin: The Chepy object.
334
+ ChepyPlugin: The Chepy object.
333
335
334
336
Examples:
335
337
>>> Chepy("tests/files/test.pcapng").read_pcap().pcap_dns_queries().o
@@ -354,13 +356,13 @@ def pcap_dns_queries(self):
354
356
355
357
@chepy .core .ChepyDecorators .call_stack
356
358
def pcap_http_streams (self ):
357
- """Get a dict of HTTP req/res
359
+ """Get a dict of HTTP req/res
360
+
361
+ This method does full fully assemble when data exceeds a
362
+ certain threshold.
358
363
359
- This method does full fully assemble when data exceeds a
360
- certain threshold.
361
-
362
364
Returns:
363
- ChepyPlugin: The Chepy object.
365
+ ChepyPlugin: The Chepy object.
364
366
"""
365
367
import scapy .layers .http as scapy_http
366
368
@@ -398,13 +400,13 @@ def pcap_http_streams(self):
398
400
@chepy .core .ChepyDecorators .call_stack
399
401
def pcap_payload (self , layer : str , bpf_filter : str = "" ):
400
402
"""Get an array of payloads based on provided layer
401
-
403
+
402
404
Args:
403
405
layer (str): Required. A valid Scapy layer.
404
- bpf_filter (str, optional): Apply a BPF filter to the packets
405
-
406
+ bpf_filter (str, optional): Apply a BPF filter to the packets
407
+
406
408
Returns:
407
- ChepyPlugin: The Chepy object.
409
+ ChepyPlugin: The Chepy object.
408
410
"""
409
411
hold = []
410
412
for packet in self ._pcap_reader_instance (bpf_filter ):
@@ -420,22 +422,22 @@ def pcap_payload(self, layer: str, bpf_filter: str = ""):
420
422
def pcap_payload_offset (
421
423
self , layer : str , start : int , end : int = None , bpf_filter : str = ""
422
424
):
423
- """Dump the raw payload by offset.
424
-
425
+ """Dump the raw payload by offset.
426
+
425
427
Args:
426
- layer (str): The layer to get the data from.
427
- start (int): The starting offset of the data to be extracted.
428
+ layer (str): The layer to get the data from.
429
+ start (int): The starting offset of the data to be extracted.
428
430
This could be a negative index number.
429
431
end (int, optional): The end index of the offset.
430
432
bpf_filter (str, optional): Apply a BPF filter to the packets
431
-
433
+
432
434
Returns:
433
- ChepyPlugin: The Chepy object.
435
+ ChepyPlugin: The Chepy object.
434
436
435
437
Examples:
436
- In this example, we are extracting all the payloads from the last 20 bytes on
437
- on the ICMP layer.
438
-
438
+ In this example, we are extracting all the payloads from the last 20 bytes on
439
+ on the ICMP layer.
440
+
439
441
>>> Chepy('tests/files/test.pcapng').read_pcap().pcap_payload_offset('ICMP', -20)
440
442
[b'secret', b'message']
441
443
"""
@@ -457,9 +459,9 @@ def pcap_to_dict(self, bpf_filter: str = ""):
457
459
458
460
Args:
459
461
bpf_filter (str, optional): Apply a BPF filter to the packets
460
-
462
+
461
463
Returns:
462
- ChepyPlugin: The Chepy object.
464
+ ChepyPlugin: The Chepy object.
463
465
"""
464
466
hold = []
465
467
for packet in self ._pcap_reader_instance (bpf_filter ):
@@ -473,9 +475,9 @@ def pcap_layer_stats(self, bpf_filter: str = ""):
473
475
474
476
Args:
475
477
bpf_filter (str, optional): Apply a BPF filter to the packets
476
-
478
+
477
479
Returns:
478
- ChepyPlugin: The Chepy object.
480
+ ChepyPlugin: The Chepy object.
479
481
"""
480
482
481
483
def get_layers (pkt ):
@@ -500,9 +502,9 @@ def pcap_convos(self, bpf_filter: str = ""):
500
502
501
503
Args:
502
504
bpf_filter (str, optional): Apply a BPF filter to the packets
503
-
505
+
504
506
Returns:
505
- ChepyPlugin: The Chepy object.
507
+ ChepyPlugin: The Chepy object.
506
508
"""
507
509
convo = collections .OrderedDict ()
508
510
@@ -526,15 +528,15 @@ def pcap_convos(self, bpf_filter: str = ""):
526
528
@chepy .core .ChepyDecorators .call_stack
527
529
def pcap_usb_keyboard (self , layout : str = "qwerty" ):
528
530
"""Decode usb keyboard pcap
529
-
531
+
530
532
Args:
531
533
layout (str, optional): Layout of the keyboard. Defaults to "qwerty".
532
-
534
+
533
535
Raises:
534
536
TypeError: If layout is not qwerty or dvorak
535
-
537
+
536
538
Returns:
537
- ChepyPlugin: The Chepy object.
539
+ ChepyPlugin: The Chepy object.
538
540
"""
539
541
if layout == "qwerty" :
540
542
key_map = PcapUSB .qwerty_map
0 commit comments