JWP-Binde-McRee-OConnor

Assessing Outbound Traffic to Uncover Advanced Persistent Threat
Appendix B - trackByGeo.py
import scapy, GeoIP, sys
from scapy.all import *
gi = GeoIP.new(GeoIP.GEOIP_MEMORY_CACHE)
dstCnt = {}
srcCnt = {}
def displayResults():
dstItems = [(v,k) for k,v in dstCnt.items()]
dstItems.sort()
dstItems.reverse()
dstItems = [(k,v) for v,k in dstItems]
srcItems = [(v,k) for k,v in srcCnt.items()]
srcItems.sort()
srcItems.reverse()
srcItems = [(k,v) for v,k in srcItems]
# Print the results
print "[*] Destination IP Address Summary for PCAP."
for item in dstItems:
print "[*] Destination Country: "+str(item[0])+", Packet Count: "+str(item[1])
print ""
print "[*] Source IP Address Summary for PCAP."
for item in srcItems:
print "[*] Source Country: "+str(item[0])+", Packet Count: "+str(item[1])
def countPkt(pkt):
if pkt.haslayer(IP):
src=pkt.getlayer(IP).src
dst=pkt.getlayer(IP).dst
srcCo = gi.country_code_by_addr(src)
dstCo = gi.country_code_by_addr(dst)
if srcCo != None :
if srcCo not in srcCnt: srcCnt[srcCo]=1
else: srcCnt[srcCo]=srcCnt[srcCo]+1
if dstCo != None:
if dstCo not in dstCnt: dstCnt[dstCo]=1
else: dstCnt[dstCo]=dstCnt[dstCo]+1
# main
if len(sys.argv) != 2:
print "[*] Usage: trackByGeo.py "
exit(0)
filename=sys.argv[1]
a=rdpcap(filename)
for pkt in a:
countPkt(pkt)
displayResults()
Page 30