This is a small tool for analysing ICS network packets.
pip install dpkt
test platform: ubuntu 16.04 64bit
view 4-tuple flow info:
python main.py -v --pcapfile=./train.pcap
save into pcap:
python main.py -f --pcapfile=./train.pcap --outputfile=./102.pcap --srcip=192.168.1.33 --srcport=1110 --dstip=192.168.1.10 --dstport=102
flow info with a fixed length:
python main.py -i --pcapfile=./102.pcap
head -20 ./out_77.txt
注意:
对pcap包有两种格式,分别用pcap和pcapng两种方式解析。如果代码报错不能解析pcap包,需对照着源码更改...