1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80#!/usr/bin/env python2
"""
Logging part of a multicast group scanner.
Needs to be run with capabilities allowing it to read
raw data from the network interface. (usually root)
Author: Lasse Karstensen <lasse.karstensen@gmail.com>, April 2013.
"""
import sys
import socket
import pcapy
import impacket
import datetime
from impacket.ImpactDecoder import EthDecoder, UDPDecoder, IPDecoder
from time import time
from pprint import pprint
INTERFACE = "eth0"
REPORT_EVERY = 4 # seconds
# List of dst-ports that pcap should filter out for us.
SKIPLIST = [
67,
137,
138,
5353, # mdns
5355,
9875, # SAP announcements
17500,
57621,
]
bintime = time()
state = {}
def print_report():
global state
now = datetime.datetime.now().isoformat()
for k, v in state.items():
if v > 1e3:
print "%s\t%s\t%i" % (now, k, v)
sys.stdout.flush()
def recv_packet(hdr, data):
global bintime
global state
frame = EthDecoder().decode(data)
ip = frame.child()
udp = ip.child()
key = ip.get_ip_dst() + "__%s" % udp.get_uh_dport()
try:
state[key] += ip.get_ip_len()
except KeyError:
state[key] = ip.get_ip_len()
now = time()
if (bintime + REPORT_EVERY) < now:
bintime = now
print_report()
state = {}
def main():
if 1:
s = pcapy.open_live(INTERFACE, 1500, True, 10)
else:
s = pcapy.open_offline("mcast.pcap")
pcapfilter = "ip proto \udp and multicast and port 4321"
# for p in SKIPLIST:
# pcapfilter += " and port not %i" % p
s.setfilter(pcapfilter)
s.loop(-1, recv_packet)
if __name__ == "__main__":
main()