Created
September 21, 2016 21:29
-
-
Save anoncontrib/c5a9ca66fac43e33cdb28569abd15a50 to your computer and use it in GitHub Desktop.
Parsing PCAP Files to extract Features
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env python | |
| # SSID Sniffer - | |
| import sys | |
| from scapy.all import * | |
| BEACON_TYPE = 0 | |
| BEACON_SUBTYPE = 8 | |
| counter = 0 | |
| import hashlib | |
| # bug: https://github.com/phaethon/scapy/issues/38 | |
| import sys | |
| def dissect_pkt(cnt, pkt, bssid, ssid) : | |
| cursor = pkt | |
| while Dot11Elt in cursor: | |
| cursor = cursor[Dot11Elt] | |
| if not cursor.len: | |
| cursor.len = 0 | |
| print '%d,%s,%d,%d,%s,%s' %(cnt, bssid, cursor.ID, cursor.len, hashlib.md5(cursor.info).hexdigest(), ssid) | |
| cursor = cursor.payload | |
| if len(cursor.payload) < 6: | |
| return | |
| def PacketHandler(pkt) : | |
| global counter, ap_list | |
| if pkt.haslayer(Dot11): | |
| if pkt.type == BEACON_TYPE and pkt.subtype == BEACON_SUBTYPE : | |
| counter +=1 | |
| dissect_pkt(counter, pkt, pkt.addr2, pkt.info) | |
| print 'packet_id,bssid,ie_type,ie_len,ie_hashvalue,ssid' | |
| sniff(offline=sys.argv[1], prn=PacketHandler, store=0) | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment