[]: {{{1

File        : README.md
Maintainer  : Felix C. Stegerman <flx@obfusk.net>
Date        : 2015-09-13

Copyright   : Copyright (C) 2015  Felix C. Stegerman
Version     : v0.1.0

[]: }}}1

Description

sniffer.py - python (2+3) network sniffer

See sniffer.py for the code (with examples).

Examples

[]: {{{1

$ sudo ./sniffer.py --filter '"TCP" in protos and "obfusk" in tcp_data'
...
[ 1441933466 | eth0 | protos: eth >> IP >> TCP >> HTTP ]:
  parsed:
    eth_source_mac          : XXXXXXXXXXXX
    eth_dest_mac            : XXXXXXXXXXXX
    eth_q_tag               : None
    eth_type                : 2048 (0x800)
    ip_source               : X.X.X.X
    ip_dest                 : 213.108.108.143
    ip_PROTO                : 6 (0x6)
    ip_TTL                  : 64 (0x40)
    tcp_source_port         : 1234 (0x4d2)
    tcp_dest_port           : 80 (50)
    tcp_seq_n               : 67890 (0x10932)
    tcp_ack_n               : 12345 (0x3039)
    tcp_flags               : ack=1 ... syn=0 ...
    tcp_win_sz              : 229 (0xe5)
    http_subtype            : HTTP_REQUEST
    http_request_line       : GET / HTTP/1.1
    http_request_method     : GET
    http_request_uri        : /
    http_request_version    : HTTP/1.1
    http_headers            :
      accept                    : */*
      host                      : obfusk.ch
      user-agent                : curl/7.44.0
    http_body               : ''
  raw:
    XX XX XX XX XX XX XX XX XX XX XX XX 08 00 45 00  XXXXXXXXXXXX..E.
    00 7d 02 07 40 00 40 06 1a cf XX XX XX XX XX XX  .}..@.@...XXXXXX
    XX XX eb 4c 00 50 be 73 a2 ee 99 18 6c ed 80 18  XX.L.P.s....l...
    00 e5 1e 15 00 00 01 01 08 0a 00 64 a0 ee 28 39  ...........d..(9
    c6 f6 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31  ..GET / HTTP/1.1
    0d 0a 48 6f 73 74 3a 20 6f 62 66 75 73 6b 2e 63  ..Host: obfusk.c
    68 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 63  h..User-Agent: c
    75 72 6c 2f 37 2e 34 34 2e 30 0d 0a 41 63 63 65  url/7.44.0..Acce
    70 74 3a 20 2a 2f 2a 0d 0a 0d 0a                 pt: */*....
...

[]: }}}1

TODO

• more parsers (DNS, ...)!
• prettier printing?!
• privilege dropping?!
• ...

License

GPLv3+ [1].

References

[1] GNU General Public License, version 3 --- https://www.gnu.org/licenses/gpl-3.0.html

[]: ! ( vim: set tw=70 sw=2 sts=2 et fdm=marker : )