Python script to calculate the time between 2 consecutive packets -


how calculate time between 2 consecutive packets? current have calculate time between 2 packets, suggestion on how improve it. have far:

class flowdict(object):

def __init__(self):     self.tcpactiveflow = dict()     self.tcpcompleteflow = list()     self.udpactiveflow = dict()     self.udpcompleteflow = list()      self.currenttime = -1     self.lastupdate = -1     self.threshold = 300     self.flowthreshold = 600   def captureonepkt(self, srcip, srcport, desip, desport, protocol, timestamp):      if "tcp" in line:          print "found tcp packet."         #add calculations         if self.currenttime == -1:             self.currenttime = timestamp          if self.lastupdate == -1:             self.lastupdate = timestamp          tcpkey1 = hash(str(srcip) + str(srcport) + str(desip) + str(desport))         tcpkey2 = hash(str(desip) + str(desport) + str(srcip) + str(srcport))          if 'tcpkey1' in self.tcpactiveflow:             self.tcpactiveflow[tcpkey1].updatesending(timestamp)             print("updated sending time flow.")         elif 'tcpkey2' in self.tcpactiveflow:             self.tcpactiveflow[tcpkey2].updatereceiving(timestamp)             print("updated receiving time flow.")         else:             f = flow(srcip, desip, srcport, desport, protocol, timestamp)             self.tcpactiveflow[tcpkey1] = f          if(self.currenttime - self.lastupdate > self.threshold):             self.lastupdate= self.currenttime              key in self.tcpactiveflow:                  if(self.currenttime - self.tcpactiveflow[tcpkey1].endtime > self.flowthreshold):                     self.tcpcompleteflow.append(self.tcpactiveflow[tcpkey1])                     del self.tcpactiveflow      if "udp" in line:         print "found udp packet."         #add calculations         if self.currenttime == -1:             self.currenttime = timestamp          if self.lastupdate == -1:             self.lastupdate = timestamp          udpkey1 = hash(str(srcip) + str(srcport) + str(desip) + str(desport))         udpkey2 = hash(str(desip) + str(desport) + str(srcip) + str(srcport))          if 'udpkey1' in self.udpactiveflow:             self.udpactiveflow[udpkey1].updatesending(timestamp)             print("updated sending time flow.")         elif 'udpkey2' in self.udpactiveflow:             self.udpactiveflow[udpkey2].updatereceiving(timestamp)             print("updated receiving time flow.")         else:             f = flow(srcip, desip, srcport, desport, protocol, timestamp)             self.udpactiveflow[udpkey1] = f          if(self.currenttime - self.lastupdate > self.threshold):             self.lastupdate= self.currenttime              key in self.udpactiveflow:                  if(self.currenttime - self.udpactiveflow[udpkey1].endtime > self.flowthreshold):                     self.udpcompleteflow.append(self.udpactiveflow[udpkey1])                     del self.udpactiveflow  def tcpwrap(self):         key in self.tcpactiveflow:         self.tcpcompleteflow.append(self.tcpactiveflow[key])         del self.tcpactiveflow  def udpwrap(self):         key in self.udpactiveflow:         self.udpcompleteflow.append(self.udpactiveflow[key])         del self.udpactiveflow  def analyze(self):     #times between 2 packets     if self.currenttime:         pass         lastupdate=self.currenttime[-1]     else:         lastupdate=false         now=self.currenttime()         self.currenttime.append(now)         if lastupdate:             return self.currenttime-lastupdate         else:             return -1 


Comments