summaryrefslogtreecommitdiff
path: root/python/examples/kaitai/microsoft_network_monitor_v2.py
diff options
context:
space:
mode:
authorAndrew Lamoureux <andrew@vector35.com>2019-03-19 17:32:44 -0400
committerRusty Wagner <rusty@vector35.com>2019-03-20 13:00:17 -0400
commit24ead55316ac8497df5842caf4e1d51f2b799787 (patch)
tree3dfdfae8a076445c9d24bf6d1b40e57f36ebf94a /python/examples/kaitai/microsoft_network_monitor_v2.py
parent411acbaa4a1d217e731d3df0b189445117be3b26 (diff)
kaitai: adjustments and rearrangements for python2/3 compat
Diffstat (limited to 'python/examples/kaitai/microsoft_network_monitor_v2.py')
-rw-r--r--python/examples/kaitai/microsoft_network_monitor_v2.py306
1 files changed, 306 insertions, 0 deletions
diff --git a/python/examples/kaitai/microsoft_network_monitor_v2.py b/python/examples/kaitai/microsoft_network_monitor_v2.py
new file mode 100644
index 00000000..3d0a14f6
--- /dev/null
+++ b/python/examples/kaitai/microsoft_network_monitor_v2.py
@@ -0,0 +1,306 @@
+# This is a generated file! Please edit source .ksy file and use kaitai-struct-compiler to rebuild
+
+from pkg_resources import parse_version
+from .kaitaistruct import __version__ as ks_version, KaitaiStruct, KaitaiStream, BytesIO
+from enum import Enum
+import collections
+
+
+if parse_version(ks_version) < parse_version('0.7'):
+ raise Exception("Incompatible Kaitai Struct Python API: 0.7 or later is required, but you have %s" % (ks_version))
+
+from windows_systemtime import WindowsSystemtime
+from ethernet_frame import EthernetFrame
+class MicrosoftNetworkMonitorV2(KaitaiStruct):
+ """Microsoft Network Monitor (AKA Netmon) is a proprietary Microsoft's
+ network packet sniffing and analysis tool. It can save captured
+ traffic as .cap files, which usually contain the packets and may
+ contain some additional info - enhanced network info, calculated
+ statistics, etc.
+
+ There are at least 2 different versions of the format: v1 and
+ v2. Netmon v3 seems to use the same file format as v1.
+
+ .. seealso::
+ Source - https://msdn.microsoft.com/en-us/library/windows/desktop/ee817717.aspx
+ """
+
+ class Linktype(Enum):
+ null_linktype = 0
+ ethernet = 1
+ ax25 = 3
+ ieee802_5 = 6
+ arcnet_bsd = 7
+ slip = 8
+ ppp = 9
+ fddi = 10
+ ppp_hdlc = 50
+ ppp_ether = 51
+ atm_rfc1483 = 100
+ raw = 101
+ c_hdlc = 104
+ ieee802_11 = 105
+ frelay = 107
+ loop = 108
+ linux_sll = 113
+ ltalk = 114
+ pflog = 117
+ ieee802_11_prism = 119
+ ip_over_fc = 122
+ sunatm = 123
+ ieee802_11_radiotap = 127
+ arcnet_linux = 129
+ apple_ip_over_ieee1394 = 138
+ mtp2_with_phdr = 139
+ mtp2 = 140
+ mtp3 = 141
+ sccp = 142
+ docsis = 143
+ linux_irda = 144
+ user0 = 147
+ user1 = 148
+ user2 = 149
+ user3 = 150
+ user4 = 151
+ user5 = 152
+ user6 = 153
+ user7 = 154
+ user8 = 155
+ user9 = 156
+ user10 = 157
+ user11 = 158
+ user12 = 159
+ user13 = 160
+ user14 = 161
+ user15 = 162
+ ieee802_11_avs = 163
+ bacnet_ms_tp = 165
+ ppp_pppd = 166
+ gprs_llc = 169
+ gpf_t = 170
+ gpf_f = 171
+ linux_lapd = 177
+ bluetooth_hci_h4 = 187
+ usb_linux = 189
+ ppi = 192
+ ieee802_15_4 = 195
+ sita = 196
+ erf = 197
+ bluetooth_hci_h4_with_phdr = 201
+ ax25_kiss = 202
+ lapd = 203
+ ppp_with_dir = 204
+ c_hdlc_with_dir = 205
+ frelay_with_dir = 206
+ ipmb_linux = 209
+ ieee802_15_4_nonask_phy = 215
+ usb_linux_mmapped = 220
+ fc_2 = 224
+ fc_2_with_frame_delims = 225
+ ipnet = 226
+ can_socketcan = 227
+ ipv4 = 228
+ ipv6 = 229
+ ieee802_15_4_nofcs = 230
+ dbus = 231
+ dvb_ci = 235
+ mux27010 = 236
+ stanag_5066_d_pdu = 237
+ nflog = 239
+ netanalyzer = 240
+ netanalyzer_transparent = 241
+ ipoib = 242
+ mpeg_2_ts = 243
+ ng40 = 244
+ nfc_llcp = 245
+ infiniband = 247
+ sctp = 248
+ usbpcap = 249
+ rtac_serial = 250
+ bluetooth_le_ll = 251
+ netlink = 253
+ bluetooth_linux_monitor = 254
+ bluetooth_bredr_bb = 255
+ bluetooth_le_ll_with_phdr = 256
+ profibus_dl = 257
+ pktap = 258
+ epon = 259
+ ipmi_hpm_2 = 260
+ zwave_r1_r2 = 261
+ zwave_r3 = 262
+ wattstopper_dlm = 263
+ iso_14443 = 264
+ SEQ_FIELDS = ["signature", "version_minor", "version_major", "mac_type", "time_capture_start", "frame_table_ofs", "frame_table_len", "user_data_ofs", "user_data_len", "comment_ofs", "comment_len", "statistics_ofs", "statistics_len", "network_info_ofs", "network_info_len", "conversation_stats_ofs", "conversation_stats_len"]
+ def __init__(self, _io, _parent=None, _root=None):
+ self._io = _io
+ self._parent = _parent
+ self._root = _root if _root else self
+ self._debug = collections.defaultdict(dict)
+
+ def _read(self):
+ self._debug['signature']['start'] = self._io.pos()
+ self.signature = self._io.ensure_fixed_contents(b"\x47\x4D\x42\x55")
+ self._debug['signature']['end'] = self._io.pos()
+ self._debug['version_minor']['start'] = self._io.pos()
+ self.version_minor = self._io.read_u1()
+ self._debug['version_minor']['end'] = self._io.pos()
+ self._debug['version_major']['start'] = self._io.pos()
+ self.version_major = self._io.read_u1()
+ self._debug['version_major']['end'] = self._io.pos()
+ self._debug['mac_type']['start'] = self._io.pos()
+ self.mac_type = KaitaiStream.resolve_enum(self._root.Linktype, self._io.read_u2le())
+ self._debug['mac_type']['end'] = self._io.pos()
+ self._debug['time_capture_start']['start'] = self._io.pos()
+ self.time_capture_start = WindowsSystemtime(self._io)
+ self.time_capture_start._read()
+ self._debug['time_capture_start']['end'] = self._io.pos()
+ self._debug['frame_table_ofs']['start'] = self._io.pos()
+ self.frame_table_ofs = self._io.read_u4le()
+ self._debug['frame_table_ofs']['end'] = self._io.pos()
+ self._debug['frame_table_len']['start'] = self._io.pos()
+ self.frame_table_len = self._io.read_u4le()
+ self._debug['frame_table_len']['end'] = self._io.pos()
+ self._debug['user_data_ofs']['start'] = self._io.pos()
+ self.user_data_ofs = self._io.read_u4le()
+ self._debug['user_data_ofs']['end'] = self._io.pos()
+ self._debug['user_data_len']['start'] = self._io.pos()
+ self.user_data_len = self._io.read_u4le()
+ self._debug['user_data_len']['end'] = self._io.pos()
+ self._debug['comment_ofs']['start'] = self._io.pos()
+ self.comment_ofs = self._io.read_u4le()
+ self._debug['comment_ofs']['end'] = self._io.pos()
+ self._debug['comment_len']['start'] = self._io.pos()
+ self.comment_len = self._io.read_u4le()
+ self._debug['comment_len']['end'] = self._io.pos()
+ self._debug['statistics_ofs']['start'] = self._io.pos()
+ self.statistics_ofs = self._io.read_u4le()
+ self._debug['statistics_ofs']['end'] = self._io.pos()
+ self._debug['statistics_len']['start'] = self._io.pos()
+ self.statistics_len = self._io.read_u4le()
+ self._debug['statistics_len']['end'] = self._io.pos()
+ self._debug['network_info_ofs']['start'] = self._io.pos()
+ self.network_info_ofs = self._io.read_u4le()
+ self._debug['network_info_ofs']['end'] = self._io.pos()
+ self._debug['network_info_len']['start'] = self._io.pos()
+ self.network_info_len = self._io.read_u4le()
+ self._debug['network_info_len']['end'] = self._io.pos()
+ self._debug['conversation_stats_ofs']['start'] = self._io.pos()
+ self.conversation_stats_ofs = self._io.read_u4le()
+ self._debug['conversation_stats_ofs']['end'] = self._io.pos()
+ self._debug['conversation_stats_len']['start'] = self._io.pos()
+ self.conversation_stats_len = self._io.read_u4le()
+ self._debug['conversation_stats_len']['end'] = self._io.pos()
+
+ class FrameIndex(KaitaiStruct):
+ SEQ_FIELDS = ["entries"]
+ def __init__(self, _io, _parent=None, _root=None):
+ self._io = _io
+ self._parent = _parent
+ self._root = _root if _root else self
+ self._debug = collections.defaultdict(dict)
+
+ def _read(self):
+ self._debug['entries']['start'] = self._io.pos()
+ self.entries = []
+ i = 0
+ while not self._io.is_eof():
+ if not 'arr' in self._debug['entries']:
+ self._debug['entries']['arr'] = []
+ self._debug['entries']['arr'].append({'start': self._io.pos()})
+ _t_entries = self._root.FrameIndexEntry(self._io, self, self._root)
+ _t_entries._read()
+ self.entries.append(_t_entries)
+ self._debug['entries']['arr'][len(self.entries) - 1]['end'] = self._io.pos()
+ i += 1
+
+ self._debug['entries']['end'] = self._io.pos()
+
+
+ class FrameIndexEntry(KaitaiStruct):
+ """Each index entry is just a pointer to where the frame data is
+ stored in the file.
+ """
+ SEQ_FIELDS = ["ofs"]
+ def __init__(self, _io, _parent=None, _root=None):
+ self._io = _io
+ self._parent = _parent
+ self._root = _root if _root else self
+ self._debug = collections.defaultdict(dict)
+
+ def _read(self):
+ self._debug['ofs']['start'] = self._io.pos()
+ self.ofs = self._io.read_u4le()
+ self._debug['ofs']['end'] = self._io.pos()
+
+ @property
+ def body(self):
+ """Frame body itself."""
+ if hasattr(self, '_m_body'):
+ return self._m_body if hasattr(self, '_m_body') else None
+
+ io = self._root._io
+ _pos = io.pos()
+ io.seek(self.ofs)
+ self._debug['_m_body']['start'] = io.pos()
+ self._m_body = self._root.Frame(io, self, self._root)
+ self._m_body._read()
+ self._debug['_m_body']['end'] = io.pos()
+ io.seek(_pos)
+ return self._m_body if hasattr(self, '_m_body') else None
+
+
+ class Frame(KaitaiStruct):
+ """A container for actually captured network data. Allow to
+ timestamp individual frames and designates how much data from
+ the original packet was actually written into the file.
+
+ .. seealso::
+ Source - https://msdn.microsoft.com/en-us/library/windows/desktop/ee831821.aspx
+ """
+ SEQ_FIELDS = ["ts_delta", "orig_len", "inc_len", "body"]
+ def __init__(self, _io, _parent=None, _root=None):
+ self._io = _io
+ self._parent = _parent
+ self._root = _root if _root else self
+ self._debug = collections.defaultdict(dict)
+
+ def _read(self):
+ self._debug['ts_delta']['start'] = self._io.pos()
+ self.ts_delta = self._io.read_u8le()
+ self._debug['ts_delta']['end'] = self._io.pos()
+ self._debug['orig_len']['start'] = self._io.pos()
+ self.orig_len = self._io.read_u4le()
+ self._debug['orig_len']['end'] = self._io.pos()
+ self._debug['inc_len']['start'] = self._io.pos()
+ self.inc_len = self._io.read_u4le()
+ self._debug['inc_len']['end'] = self._io.pos()
+ self._debug['body']['start'] = self._io.pos()
+ _on = self._root.mac_type
+ if _on == self._root.Linktype.ethernet:
+ self._raw_body = self._io.read_bytes(self.inc_len)
+ io = KaitaiStream(BytesIO(self._raw_body))
+ self.body = EthernetFrame(io)
+ self.body._read()
+ else:
+ self.body = self._io.read_bytes(self.inc_len)
+ self._debug['body']['end'] = self._io.pos()
+
+
+ @property
+ def frame_table(self):
+ """Index that is used to access individual captured frames."""
+ if hasattr(self, '_m_frame_table'):
+ return self._m_frame_table if hasattr(self, '_m_frame_table') else None
+
+ _pos = self._io.pos()
+ self._io.seek(self.frame_table_ofs)
+ self._debug['_m_frame_table']['start'] = self._io.pos()
+ self._raw__m_frame_table = self._io.read_bytes(self.frame_table_len)
+ io = KaitaiStream(BytesIO(self._raw__m_frame_table))
+ self._m_frame_table = self._root.FrameIndex(io, self, self._root)
+ self._m_frame_table._read()
+ self._debug['_m_frame_table']['end'] = self._io.pos()
+ self._io.seek(_pos)
+ return self._m_frame_table if hasattr(self, '_m_frame_table') else None
+
+