Cody Brocious

#!/usr/bin/env python# encoding: utf-8"""Capture.pyCreated by Cody Brocious on 2007-04-07.Copyright (c) 2006 Cody Brocious All rights reserved."""import sys, struct, pcapy, impacket, impacket.ImpactDecoderPORTS = (9008, )ASCII = 'abcdefghijklmnopqrstuvwxyz'.upper() + 'abcdefghijklmnopqrstuvwxyz0123456789`~!@#$%^&*()_+=-[]{}\\|<>?,./:;\'"'class Packet:    def __init__(self, src, dest, packet):        self.src = src        self.dest = dest        self.packet = packet                self.decode(packet)        def decode(self, packet):        header, data = packet[0:16], packet[16:]                key, plen = struct.unpack('<LL', header[:8])                if len(packet) == plen + 0x16:            print 'Unencrypted'        else:            pass        def __str__(self):        # ret = '%r -> %r\n' % (self.src, self.dest)        if self.src[1] in PORTS:            ret = 'S->C\n'        else:            ret = 'C->S\n'                for i in range(0, len(self.packet), 16):            ret += '%08X  ' % i                        for j in range(16):                if j == 8:                    ret += ' '                                if i+j >= len(self.packet):                    ret += '   '                else:                    ret += '%02X ' % ord(self.packet[i+j])                        ret += ' |  '                        for j in range(16):                if j == 8:                    ret += ' '                                if i+j >= len(self.packet):                    ret += ' '                else:                    c = self.packet[i+j]                                        if c.lower() in ASCII:                        ret += c                    else:                        ret += '.'                        ret += '\n'                strings = []        buf = ''        last = None                for c in self.packet:            if c in ASCII:                buf += c                last = ASCII            else:                if last != ASCII:                    if len(buf) > 2:                        strings.append(buf)                    buf = ''                last = None                if len(buf) > 2:            strings.append(buf)                ret += '%08X\n' % len(self.packet)                if len(strings):            ret += 'Strings: %s\n' % ' '.join(strings)                return retclass Capture:    def __init__(self, args):        self.reader = pcapy.open_offline(args[0])        # self.reader = pcapy.open_live(args[0], 65536, True, 100)        self.decoder = impacket.ImpactDecoder.EthDecoder()                while True:            try:                header, data = self.reader.next()            except:                break            eth = self.decoder.decode(data)            ip = eth.child()            if ip.__class__ != impacket.ImpactPacket.IP:                continue                        sip = ip.get_ip_src()            dip = ip.get_ip_dst()                        child = ip.child()                        if child.__class__ == impacket.ImpactPacket.UDP:                self.handleUDP(sip, dip, child)        def handleUDP(self, sip, dip, child):        sport = child.get_uh_sport()        dport = child.get_uh_dport()        packet = child.get_data_as_string()                if sport not in PORTS and dport not in PORTS:            return                packet = Packet((sip, sport), (dip, dport), packet)        print packet    if __name__=='__main__':    Capture(sys.argv[1:])