-
Notifications
You must be signed in to change notification settings - Fork 2
batidiane/Network-Entropy
Folders and files
Name | Name | Last commit message | Last commit date | |
---|---|---|---|---|
Repository files navigation
Modular entropy calculation from network capture ------------------------------------------------ The project objective is to use a pcap file or a live pcap stream to calculate the entropy of the TCP and UDP payload of packets seen using different algorithms (shannon or a approximation of kolmogorov) First Step: Packet entropy calculation from capture file -------------------------------------------------------- capanalyser.py calculate entropy of packets from a capture file using: - shannon entropy - an approximation of kolmogorov entropy by using the compression rate of the packet Second Step: calculate entropy from a capture file or from live capture stream ------------------------------------------------------------------------------ netentropy.py calculate TCP, UDP and ICMP payload entropy from capture file or from live stream. Several option are added to format the output. How to use it: -------------- netentropy.py [-h] [-i INTERFACE | -f PCAPFILE] [-a {sha,kol}] bpf Calculate entropy from live capture or pcap file positional arguments: bpf BPF filter like "tcp and port 22" optional arguments: -h, --help show this help message and exit -i INTERFACE, --interface INTERFACE live capture from an interface (default:lo) -f PCAPFILE, --file PCAPFILE filename of a capture file to read from -a {sha,kol}, --algo {sha,kol} entropy algorithm. 2 choices: "sha" for shannon entropy or "kol" for kolmogorov You will need to install the dpkt library (http://code.google.com/p/dpkt/) Output format: -------------- epoch | ip_src:port > ip_dst:port | protocole name | entropy | payload length samples: 1359930733 | 192.168.178.25:59063 > 173.194.70.113:443 | proto:TCP | sha:1.503114 | len:450 1359931779 | 173.194.70.19:443 > 192.168.178.25:34729 | proto:TCP | kol:1.196429 | len:450
About
Modular entropy calculation from network capture
Resources
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published