FazBrowse GitHub Viewer
|
Trending
|
URL:
|
Home
Tools:
[Download Repo ZIP]
[View Raw Code]
[Original HTTPS Page]
python-kasa/devtools/parse_pcap.py at master · python-kasa/python-kasa · GitHub
python-kasa
python-kasa
Repository navigation
Code
Issues
60
(60)
Pull requests
39
(39)
Discussions
Actions
Projects
Security and quality
Insights
Expand file tree
Breadcrumbs
python-kasa
/
devtools
/
parse_pcap.py
Copy path
More file actions
More file actions
Latest commit
History
History
History
101 lines (79 loc) · 3.08 KB
Breadcrumbs
python-kasa
/
devtools
/
parse_pcap.py
Copy path
File metadata and controls
101 lines (79 loc) · 3.08 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
"""Parse pcaps for TP-Link communications."""
import
json
from
collections
import
Counter
,
defaultdict
from
pprint
import
pformat
as
pf
import
click
import
dpkt
from
dpkt
.
ethernet
import
ETH_TYPE_IP
,
Ethernet
from
kasa
.
cli
.
main
import
echo
from
kasa
.
transports
.
xortransport
import
XorEncryption
def
read_payloads_from_file
(
file
):
"""Read the given pcap file and yield json payloads."""
pcap
=
dpkt
.
pcap
.
Reader
(
file
)
for
_ts
,
pkt
in
pcap
:
eth
=
Ethernet
(
pkt
)
if
eth
.
type
!=
ETH_TYPE_IP
:
continue
ip
=
eth
.
ip
if
ip
.
p
==
6
:
transport
=
ip
.
tcp
elif
ip
==
17
:
transport
=
ip
.
udp
else
:
continue
if
transport
.
sport
!=
9999
and
transport
.
dport
!=
9999
:
continue
data
=
transport
.
data
try
:
decrypted
=
XorEncryption
.
decrypt
(
data
[
4
:])
except
Exception
as
ex
:
echo
(
f"[red]Unable to decrypt the data, ignoring:
{
ex
}
[/red]"
)
continue
if
not
decrypted
:
# skip empty payloads
continue
try
:
json_payload
=
json
.
loads
(
decrypted
)
except
Exception
as
ex
:
# this can happen when the response is split into multiple tcp segments
echo
(
f"[red]Unable to parse payload '
{
decrypted
}
', ignoring:
{
ex
}
[/red]"
)
continue
if
not
json_payload
:
# ignore empty payloads
echo
(
"[red]Got empty payload, ignoring[/red]"
)
continue
yield
json_payload
@
click
.
command
()
@
click
.
argument
(
"file"
,
type
=
click
.
File
(
"rb"
))
def
parse_pcap
(
file
):
"""Parse pcap file and pretty print the communications and some statistics."""
seen_items
=
defaultdict
(
Counter
)
for
json_payload
in
read_payloads_from_file
(
file
):
context
=
json_payload
.
pop
(
"context"
,
""
)
for
module
,
cmds
in
json_payload
.
items
():
seen_items
[
"modules"
][
module
]
+=
1
if
"err_code"
in
cmds
:
echo
(
f"[red]Got error for module:
{
cmds
}
[/red]"
)
continue
for
cmd
,
response
in
cmds
.
items
():
seen_items
[
"commands"
][
cmd
]
+=
1
seen_items
[
"full_command"
][
f"
{
module
}
.
{
cmd
}
"
]
+=
1
if
response
is
None
:
continue
direction
=
">>"
if
response
is
None
:
echo
(
f"got none as response for
{
cmd
}
%s, weird?"
)
continue
is_success
=
"[green]+[/green]"
if
"err_code"
in
response
:
direction
=
"<<"
if
response
[
"err_code"
]
!=
0
:
seen_items
[
"errorcodes"
][
response
[
"err_code"
]]
+=
1
seen_items
[
"errors"
][
response
[
"err_msg"
]]
+=
1
is_success
=
"[red]![/red]"
context_str
=
f" [ctx:
{
context
}
]"
if
context
else
""
echo
(
f"[
{
is_success
}
]
{
direction
}
{
context_str
}
{
module
}
.
{
cmd
}
:"
f"
{
pf
(
response
)
}
"
)
echo
(
pf
(
seen_items
))
if
__name__
==
"__main__"
:
parse_pcap
()
Back
|
FazBrowse Home
|
New Git URL