how calculate time between 2 consecutive packets? current have calculate time between 2 packets, suggestion on how improve it. have far:
class flowdict(object):
def __init__(self): self.tcpactiveflow = dict() self.tcpcompleteflow = list() self.udpactiveflow = dict() self.udpcompleteflow = list() self.currenttime = -1 self.lastupdate = -1 self.threshold = 300 self.flowthreshold = 600 def captureonepkt(self, srcip, srcport, desip, desport, protocol, timestamp): if "tcp" in line: print "found tcp packet." #add calculations if self.currenttime == -1: self.currenttime = timestamp if self.lastupdate == -1: self.lastupdate = timestamp tcpkey1 = hash(str(srcip) + str(srcport) + str(desip) + str(desport)) tcpkey2 = hash(str(desip) + str(desport) + str(srcip) + str(srcport)) if 'tcpkey1' in self.tcpactiveflow: self.tcpactiveflow[tcpkey1].updatesending(timestamp) print("updated sending time flow.") elif 'tcpkey2' in self.tcpactiveflow: self.tcpactiveflow[tcpkey2].updatereceiving(timestamp) print("updated receiving time flow.") else: f = flow(srcip, desip, srcport, desport, protocol, timestamp) self.tcpactiveflow[tcpkey1] = f if(self.currenttime - self.lastupdate > self.threshold): self.lastupdate= self.currenttime key in self.tcpactiveflow: if(self.currenttime - self.tcpactiveflow[tcpkey1].endtime > self.flowthreshold): self.tcpcompleteflow.append(self.tcpactiveflow[tcpkey1]) del self.tcpactiveflow if "udp" in line: print "found udp packet." #add calculations if self.currenttime == -1: self.currenttime = timestamp if self.lastupdate == -1: self.lastupdate = timestamp udpkey1 = hash(str(srcip) + str(srcport) + str(desip) + str(desport)) udpkey2 = hash(str(desip) + str(desport) + str(srcip) + str(srcport)) if 'udpkey1' in self.udpactiveflow: self.udpactiveflow[udpkey1].updatesending(timestamp) print("updated sending time flow.") elif 'udpkey2' in self.udpactiveflow: self.udpactiveflow[udpkey2].updatereceiving(timestamp) print("updated receiving time flow.") else: f = flow(srcip, desip, srcport, desport, protocol, timestamp) self.udpactiveflow[udpkey1] = f if(self.currenttime - self.lastupdate > self.threshold): self.lastupdate= self.currenttime key in self.udpactiveflow: if(self.currenttime - self.udpactiveflow[udpkey1].endtime > self.flowthreshold): self.udpcompleteflow.append(self.udpactiveflow[udpkey1]) del self.udpactiveflow def tcpwrap(self): key in self.tcpactiveflow: self.tcpcompleteflow.append(self.tcpactiveflow[key]) del self.tcpactiveflow def udpwrap(self): key in self.udpactiveflow: self.udpcompleteflow.append(self.udpactiveflow[key]) del self.udpactiveflow def analyze(self): #times between 2 packets if self.currenttime: pass lastupdate=self.currenttime[-1] else: lastupdate=false now=self.currenttime() self.currenttime.append(now) if lastupdate: return self.currenttime-lastupdate else: return -1
Comments
Post a Comment