scapy를 이용한 network 패킷 분석 에 이어서 scapy를 이용한 http network 패킷 분석 프로그램을 만들어보았다.
우선은 sniffing 하지 않고 그냥 pcap 파일을 읽어서 하는 방식으로 작업했다.
(PacketInside.com 의 Examples 을 입맛에 맞게 수정했다.)
pcap의 파일에서 200개의 패킷을 읽어서 http의 request와 response 의 특정 header 정보를 출력한다.
]$ cat ./http.py
#!/usr/bin/python
import sys
from scapy.all import *
CNT = 200
p_list = list()
def run(target):
try:
pkt = rdpcap(target, count=CNT)
except MemoryError:
print "Sorry - Memory Error"
sys.exit()
numPkt = len(pkt)
print "Analyzing : " + target
print "Total Packets: %d\n" % numPkt
for packet in pkt:
layer = packet.payload
p_dict = dict()
while layer:
layerName = layer.name
if layerName == "IP":
p_dict["srcip"] = layer.src
p_dict["dstip"] = layer.dst
if layerName == "TCP":
if layer.flags == 2 : flags = "SYN"
if layer.flags == 16 : flags = "ACK"
if layer.flags == 17 : flags = "FIN,ACK"
if layer.flags == 18 : flags = "SYN,ACK"
if layer.flags == 24 : flags = "PSH,ACK"
p_dict["sport"] = layer.sport
p_dict["dport"] = layer.dport
p_dict["seq"] = layer.seq
p_dict["ack"] = layer.ack
p_dict["flags"] = flags
if layerName == "Raw":
result = processHTTP(layer.load)
for k,v in result.items() :
p_dict[k] = v
layer = layer.payload
if p_dict.has_key("http") :
p_list.append(p_dict)
print(p_dict)
def processHTTP(data):
info = dict()
headers = str(data).splitlines();
for header in headers:
if header.startswith("GET") :
info["http"] = "request"
info["method"] = header.split()[0]
info["uri"] = header.split()[1]
if header.startswith("POST") :
info["http"] = "request"
info["method"] = header.split()[0]
info["uri"] = header.split()[1]
if header.startswith("HTTP") :
info["http"] = "response"
info["status"] = header.split()[1]
if header.startswith("HOST") : info["host"] = header.split(":",1)[1]
if header.startswith("User-Agent") : info["user-agent"] = header.split(":",1)[1]
if header.startswith("Referer") : info["referer"] = header.split(":",1)[1]
if header.startswith("Cookie") : info["cookies"] = header.split(":",1)[1]
return info
run("test11.pcap")
결과는 아래와 같이 나온다.
]$ sudo ./http.py
WARNING: No route found for IPv6 destination :: (no default route?)
Analyzing : test11.pcap
Total Packets: 200
{'cookies': ' NNB=2KYKWJCN7IRVC; NB=GE4TKMJXGEYTOMRY; npic=yJlHW+olU5oYh40SmhtyJhoT23h+BF06nbGA+rwVWwXxx96MBYWsAgwUfWvmyHUvCA==; nid_inf=-1714996177; NID_AUT=Wzd/5wWYo/OJZqTVX2Udv9AIE2eknJRIM2v+stdCUCDCOg5CWxJKM0pIxn80bf6zSTMbVkf6jh+CWSAmrL22PdN+LRrKMJ6JV2tjl9RFqRcWfA/HRfL5j6u57huHJQO7; pop_1359091437=Y; NID_SES=AAABUkyR9gUxxea1Gfn8Bh2N8atxE8w69JYpxc6PCdbrbFx43LDJkGk/ICX25WD58+H59c1PLuXojIEevpTjiOQh2O5s6MuD3jTRPCMyYzVLFYnU1L2NaRAf3OrIlxtsvMNqpbcJTxLrjuJmyw7z1iuSVSxfQ2b4wMqQhS/YX3lsZI8lsPHihfYGDmVLliQxXHvi8QzIZBuudI/VGqXfcYE74np8FBovl371yMSWGV+lXFYi3NfsOGcyJF8hUlAdquRh8PQ4USJ80X5mteax9m41/DqWFeNw0bD0XmaNtbv6ouCRI+6cmcKO0OGD7l6xhS8bcZn40pm/QlKcsoto8hkrV4Ub2zGXKhqsI9jq09BJrgpez2Pfq7N9r9F9yXgTHNuo6Js6Y9Il9U5EbLBu3OC4QCY8HSukgwr/FD9AK2WI76MxTFCxOCrCU5OlPIT7rBZ7ELDybxGQ2M01ASG0HKNYpyA=; page_uid=Rfd0IF5Y7uNsstnSKWdsssssstw-264956; _naver_usersession_=USQ04nJvL', 'dstip': 'xxx.xxx.xxx.10', 'http': 'request', 'seq': 863658826, 'ack': 120913057, 'uri': 'http://cr.naver.com/rd?m=0&px=290&py=354&sx=290&sy=354&p=Rfd0IF5Y7uNsstnSKWdsssssstw-264956&q=tshark&ssc=tab.nx.all&f=nexearch&w=nexearch&s=USQ04nJvLCoAACRVczk&time=1361327412508&t=2&a=blg_1st*x.tit&r=3&i=a00000fa_9090bfaa4d6feb6d8b3a3ed2&u=http%3A//www.xxxxxxxx.com/wp/%3Fp%3D1082&cr=1', 'user-agent': ' Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17', 'dport': 8080, 'flags': 'PSH,ACK', 'srcip': 'xxx.xxx.xxx.242', 'referer': ' http://search.xxxxxx.com/search?..............', 'sport': 52211, 'method': 'GET'}
{'dstip': 'xxx.xxx.xxx.10', 'http': 'request', 'seq': 823727297, 'ack': 3321226627, 'uri': 'http://www.xxxxxxxx.com/wp/?p=1082', 'user-agent': ' Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17', 'dport': 8080, 'flags': 'PSH,ACK', 'srcip': 'xxx.xxx.xxx.242', 'referer': ' http://search.xxxx.com/search?...........', 'sport': 52217, 'method': 'GET'}
{'status': '204', 'dstip': 'xxx.xxx.xxx.242', 'http': 'response', 'seq': 120913057, 'ack': 863660437, 'dport': 52211, 'flags': 'PSH,ACK', 'srcip': 'xxx.xxx.xxx.10', 'sport': 8080}
{'status': '200', 'dstip': 'xxx.xxx.xxx.242', 'http': 'response', 'seq': 3321226627, 'ack': 823727842, 'dport': 52217, 'flags': 'ACK', 'srcip': 'xxx.xxx.xxx.10', 'sport': 8080}
{'dstip': 'xxx.xxx.xxx.10', 'http': 'request', 'seq': 551180696, 'ack': 834479893, 'uri': 'http://connect.xxxxxx.net/en_US/all.js', 'user-agent': ' Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17', 'dport': 8080, 'flags': 'PSH,ACK', 'srcip': 'xxx.xxx.xxx.242', 'referer': ' http://www.xxxxxxxx.com/wp/?p=1082', 'sport': 52218, 'method': 'GET'}
{'status': '304', 'dstip': 'xxx.xxx.xxx.242', 'http': 'response', 'seq': 834479893, 'ack': 551181181, 'dport': 52218, 'flags': 'PSH,ACK', 'srcip': 'xxx.xxx.xxx.10', 'sport': 8080}
{'status': '200', 'dstip': 'xxx.xxx.xxx.242', 'http': 'response', 'seq': 3935123174, 'ack': 2420200966, 'dport': 52219, 'flags': 'PSH,ACK', 'srcip': 'xxx.xxx.xxx.10', 'sport': 8080}
{'status': '200', 'dstip': 'xxx.xxx.xxx.242', 'http': 'response', 'seq': 590452402, 'ack': 1882676730, 'dport': 52224, 'flags': 'PSH,ACK', 'srcip': 'xxx.xxx.xxx.10', 'sport': 8080}
{'status': '200', 'dstip': 'xxx.xxx.xxx.242', 'http': 'response', 'seq': 356404777, 'ack': 3908736851, 'dport': 52223, 'flags': 'PSH,ACK', 'srcip': 'xxx.xxx.xxx.10', 'sport': 8080}
{'status': '200', 'dstip': 'xxx.xxx.xxx.242', 'http': 'response', 'seq': 3725610989, 'ack': 3843291703, 'dport': 52220, 'flags': 'PSH,ACK', 'srcip': 'xxx.xxx.xxx.10', 'sport': 8080}
{'status': '200', 'dstip': 'xxx.xxx.xxx.242', 'http': 'response', 'seq': 1730383986, 'ack': 3715684314, 'dport': 52222, 'flags': 'PSH,ACK', 'srcip': 'xxx.xxx.xxx.10', 'sport': 8080}
{'status': '200', 'dstip': 'xxx.xxx.xxx.242', 'http': 'response', 'seq': 1561795117, 'ack': 3516294071, 'dport': 52221, 'flags': 'PSH,ACK', 'srcip': 'xxx.xxx.xxx.10', 'sport': 8080}
2 Responses to scapy를 이용한 http network 패킷 분석 프로그램