python解析pcap转储为sqlite

最近有需求对pcap包进行处理，要求提取数据包中的字段，并存储到sqlite数据库中，于是乎利用scapy写了一个简单的脚本，其中包括了对IP、TCP、UDP、ICMP包的解析，其实代码重复了许多，但是为了追求工作的效率，暂且留下这段代码吧，后续慢慢优化~大神莫见怪。

#! -- coding:utf-8 --
from scapy.all import *
import sqlite3
import getopt

global output_database

def ip_insert_db(packet_dict):
    db = sqlite3.connect(output_database)
    cur = db.cursor()
    #cur.execute('DROP TABLE IF EXISTS APACHE_LOG')
    cur.execute('''CREATE TABLE IF NOT EXISTS IP_PACKET(
    eventno INTEGER,
    eventtype TEXT,
    timestamp INTEGER,
    timestampusec INTEGER,
    sipaddr TEXT,
    dipaddr TEXT,
    totalpacketlen INTEGER,
    protocol INTEGER,
    tos INTEGER,
    ipid INTEGER,
    ipcksum INTEGER,
    ipttl INTEGER
    )''')


    query = '''insert into IP_PACKET (eventno,eventtype,timestamp,timestampusec,sipaddr,dipaddr,totalpacketlen,
                protocol,tos,ipid,ipcksum,ipttl) values ('%d','%s','%d','%d','%s','%s','%d','%d','%d','%d','%d','%d');''' \
            % (packet_dict['evento'],packet_dict['eventtype'],packet_dict['timestamp'],packet_dict['timestampusec'],packet_dict['sipaddr'],packet_dict['dipaddr'],
               packet_dict['totalpacketlen'],packet_dict['protocol'],packet_dict['tos'],packet_dict['ipid'],packet_dict['ipcksum'],packet_dict['ipttl'])
    cur.execute(query)
    db.commit()
    cur.close()
    db.close()
    return
def tcp_insert_db(packet_dict):
    db = sqlite3.connect(output_database)
    cur = db.cursor()
    #cur.execute('DROP TABLE IF EXISTS APACHE_LOG')
    cur.execute('''CREATE TABLE IF NOT EXISTS TCP_PACKET(
    eventno INTEGER,
    eventtype TEXT,
    timestamp INTEGER,
    timestampusec INTEGER,
    sipaddr TEXT,
    dipaddr TEXT,
    sport INTEGER,
    dport INTEGER,
    totalpacketlen INTEGER,
    protocol INTEGER,
    tos INTEGER,
    ipid INTEGER,
    ipcksum INTEGER,
    ipttl INTEGER,
    tcpseq TEXT,
    tcpack TEXT,
    tcpflags TEXT
    )''')


    query = '''insert into TCP_PACKET (eventno,eventtype,timestamp,timestampusec,sipaddr,dipaddr,sport,dport,totalpacketlen,
                protocol,tos,ipid,ipcksum,ipttl,tcpseq,tcpack,tcpflags) values (%d,'%s','%d','%d','%s','%s','%d','%d','%d','%d','%d','%d','%d','%d',
                '%s','%s','%s');''' \
            % (packet_dict['evento'],packet_dict['eventtype'],packet_dict['timestamp'],packet_dict['timestampusec'],packet_dict['sipaddr'],packet_dict['dipaddr'],
               packet_dict['sport'], packet_dict['dport'],packet_dict['totalpacketlen'],packet_dict['protocol'],packet_dict['tos'],packet_dict['ipid'],
               packet_dict['ipcksum'],packet_dict['ipttl'],packet_dict['tcpseq'],packet_dict['tcpack'],packet_dict['tcpflags'])


    cur.execute(query)
    db.commit()
    cur.close()
    db.close()
    return
def udp_insert_db(packet_dict):
    db = sqlite3.connect(output_database)
    cur = db.cursor()
    #cur.execute('DROP TABLE IF EXISTS APACHE_LOG')
    cur.execute('''CREATE TABLE IF NOT EXISTS UDP_PACKET(
    eventno INTEGER,
    eventtype TEXT,
    timestamp INTEGER,
    timestampusec INTEGER,
    sipaddr TEXT,
    dipaddr TEXT,
    sport INTEGER,
    dport INTEGER,
    totalpacketlen INTEGER,
    protocol INTEGER,
    tos INTEGER,
    ipid INTEGER,
    ipcksum INTEGER,
    ipttl INTEGER,
    udplen INTEGER,
    udpcksum INTEGER
    )''')


    query = '''insert into UDP_PACKET (eventno,eventtype,timestamp,timestampusec,sipaddr,dipaddr,sport,dport,totalpacketlen,
                protocol,tos,ipid,ipcksum,ipttl,udplen,udpcksum) values (%d,'%s','%d','%d','%s','%s','%d','%d','%d','%d','%d','%d','%d','%d',
                '%d','%d');''' \
            % (packet_dict['evento'],packet_dict['eventtype'],packet_dict['timestamp'],packet_dict['timestampusec'],packet_dict['sipaddr'],packet_dict['dipaddr'],
               packet_dict['sport'], packet_dict['dport'],packet_dict['totalpacketlen'],packet_dict['protocol'],packet_dict['tos'],packet_dict['ipid'],
               packet_dict['ipcksum'],packet_dict['ipttl'],packet_dict['udplen'],packet_dict['udpcksum'])


    cur.execute(query)
    db.commit()
    cur.close()
    db.close()
    return
def icmp_insert_db(packet_dict):
    db = sqlite3.connect(output_database)
    cur = db.cursor()
    #cur.execute('DROP TABLE IF EXISTS APACHE_LOG')
    cur.execute('''CREATE TABLE IF NOT EXISTS ICMP_PACKET(
    eventno INTEGER,
    eventtype TEXT,
    timestamp INTEGER,
    timestampusec INTEGER,
    sipaddr TEXT,
    dipaddr TEXT,
    totalpacketlen INTEGER,
    protocol INTEGER,
    tos INTEGER,
    ipid INTEGER,
    ipcksum INTEGER,
    ipttl INTEGER,
    icmptype INTEGER,
    icmpcode INTEGER,
    icmpcksum INTEGER
    )''')


    query = '''insert into ICMP_PACKET (eventno,eventtype,timestamp,timestampusec,sipaddr,dipaddr,totalpacketlen,
                protocol,tos,ipid,ipcksum,ipttl,icmptype,icmpcode,icmpcksum) values (%d,'%s','%d','%d','%s','%s','%d','%d','%d','%d','%d','%d',
                '%d','%d','%d');''' \
            % (packet_dict['evento'],packet_dict['eventtype'],packet_dict['timestamp'],packet_dict['timestampusec'],packet_dict['sipaddr'],packet_dict['dipaddr'],
               packet_dict['totalpacketlen'],packet_dict['protocol'],packet_dict['tos'],packet_dict['ipid'],packet_dict['ipcksum'],packet_dict['ipttl'],
               packet_dict['icmptype'],packet_dict['icmpcode'],packet_dict['icmpcksum'])


    cur.execute(query)
    db.commit()
    cur.close()
    db.close()
    return
def tcp_parse(pcaps):
    '''
    evento  i
    eventtype
    timestamp  i
    timestampusec    i
    sipaddr
    dipaddr
    sport  i
    dport
    totalpacketlen
    protocol
    tos
    ipid
    ipcksum
    ipttl  i
    tcpseq
    tcpack
    tcpflags
    :param pcaps:
    :return:
    '''
    tcp_dict = dict()
    tcp_object = pcaps[TCP]
    count = 0
    tcp_dict['eventtype']="TCP_PACKET"
    try:
        while (tcp_object[count]):
            tcp_dict['evento'] = count
            tcp_dict['timestamp'] = tcp_object[count][TCP].time
            tcp_dict['timestampusec'] = 1
            tcp_dict['sipaddr'] = tcp_object[count][IP].src
            tcp_dict['dipaddr'] = tcp_object[count][IP].dst
            tcp_dict['sport'] = tcp_object[count][TCP].sport
            tcp_dict['dport'] = tcp_object[count][TCP].dport
            tcp_dict['totalpacketlen'] = tcp_object[count][IP].len
            tcp_dict['protocol'] = tcp_object[count][IP].proto
            tcp_dict['tos'] = tcp_object[count][IP].tos
            tcp_dict['ipid'] = tcp_object[count][IP].id
            tcp_dict['ipcksum'] = tcp_object[count][IP].chksum
            tcp_dict['ipttl'] = tcp_object[count][IP].ttl
            tcp_dict['tcpseq'] = tcp_object[count][TCP].seq
            tcp_dict['tcpack'] = tcp_object[count][TCP].ack
            tcp_dict['tcpflags'] = tcp_object[count][TCP].flags
            tcp_insert_db(tcp_dict)
            count = count + 1
    except Exception as e:
        print e
    return
def icmp_parse(pcaps):


    '''
    eventno
    eventtype t
    timestamp
    timestampusec
    sipaddr t
    dipaddr t
    totalpacketlen
    protocol
    tos
    ipid
    ipoffset
    ipcksum
    ipttl
    icmptype
    icmpcode
    icmpcksum
    :param pcaps: 
    :return: 
    '''


    icmp_dict = dict()
    icmp_object = pcaps[ICMP]
    count = 0
    icmp_dict['eventtype']="ICMP_PACKET"
    try:
        while (icmp_object[count]):
            icmp_dict['evento'] = count
            icmp_dict['timestamp'] = icmp_object[count][ICMP].time
            icmp_dict['timestampusec'] = 1
            icmp_dict['sipaddr'] = icmp_object[count][IP].src
            icmp_dict['dipaddr'] = icmp_object[count][IP].dst
            icmp_dict['totalpacketlen'] = icmp_object[count][IP].len
            icmp_dict['protocol'] = icmp_object[count][IP].proto
            icmp_dict['tos'] = icmp_object[count][IP].tos
            icmp_dict['ipid'] = icmp_object[count][IP].id
            icmp_dict['ipcksum'] = icmp_object[count][IP].chksum
            icmp_dict['ipttl'] = icmp_object[count][IP].ttl
            icmp_dict['icmptype'] = icmp_object[count][ICMP].type
            icmp_dict['icmpcode'] = icmp_object[count][ICMP].code
            icmp_dict['icmpcksum'] = icmp_object[count][ICMP].chksum
            icmp_insert_db(icmp_dict)
            count = count + 1
    except Exception as e:
        print e
    return
def udp_parse(pcaps):
    '''
    udp:
    evento
    eventtype
    timestamp
    timestampusec
    sipaddr
    dipaddr
    sport
    dport
    totalpacketlen
    protocol
    tos
    ipid
    ipcksum
    ipttl
    udplen
    udpchksum


    :param pcaps:
    :return:
    '''
    udp_dict = dict()
    udp_object = pcaps[UDP]
    count = 0
    udp_dict['eventtype']="UDP_PACKET"
    try:
        while (udp_object[count]):
            udp_dict['evento'] = count
            udp_dict['timestamp'] = udp_object[count][UDP].time
            udp_dict['timestampusec'] = 1
            udp_dict['sipaddr'] = udp_object[count][IP].src
            udp_dict['dipaddr'] = udp_object[count][IP].dst
            udp_dict['sport'] = udp_object[count][UDP].sport
            udp_dict['dport'] = udp_object[count][UDP].dport
            udp_dict['totalpacketlen'] = udp_object[count][IP].len
            udp_dict['protocol'] = udp_object[count][IP].proto
            udp_dict['tos'] = udp_object[count][IP].tos
            udp_dict['ipid'] = udp_object[count][IP].id
            udp_dict['ipcksum'] = udp_object[count][IP].chksum
            udp_dict['ipttl'] = udp_object[count][IP].ttl
            udp_dict['udplen'] = udp_object[count][UDP].len
            udp_dict['udpcksum'] = udp_object[count][UDP].chksum
            udp_insert_db(udp_dict)
            count = count + 1
    except Exception as e:
        print e


    return
def ip_parse(pcaps):
    '''
    evento  i
    eventtype
    timestamp  i
    timestampusec    i
    sipaddr
    dipaddr
    totalpacketlen
    protocol
    tos
    ipid
    ipcksum
    ipttl  i
    :param pcaps: 
    :return: 
    '''
    
    ip_dict = dict()
    ip_object = pcaps[IP]
    count = 0
    ip_dict['eventtype']="IP_PACKET"
    try:
        while (ip_object[count]):
            ip_dict['evento'] = count
            ip_dict['timestamp'] = ip_object[count][IP].time
            ip_dict['timestampusec'] = 1
            ip_dict['sipaddr'] = ip_object[count][IP].src
            ip_dict['dipaddr'] = ip_object[count][IP].dst
            ip_dict['totalpacketlen'] = ip_object[count][IP].len
            ip_dict['protocol'] = ip_object[count][IP].proto
            ip_dict['tos'] = ip_object[count][IP].tos
            ip_dict['ipid'] = ip_object[count][IP].id
            ip_dict['ipcksum'] = ip_object[count][IP].chksum
            ip_dict['ipttl'] = ip_object[count][IP].ttl
            ip_insert_db(ip_dict)
            count = count + 1
    except Exception as e:
        print e
        
    return
def usage():
    print   '''
     ###########################################################
     #                                                         #
     #                   Plugin for Datadump                   #
     #                                                         #
     # Description:                                            #
     #    Data dump can parse the pcap file and store it in    #
     #    the SQLite database.                                 #
     #    Currently can handle IP, TCP, UDP, ICMP types of     #
     #    data packets.                                        #
     #                                                         #
     #                                       Author:test       #
     ###########################################################


./packet_parse.py -i <pcapfile>  -o  <sqlitedatabase>


Parameter
===========
-i/--input  : input pcapfile
-o/--output : output sqlite file


example：
        python packet_parse.py -i input.pcap -o output.sqlite
        or
        python packet_parse.py --input=input.pcap --ouput=output.sqlite
            '''
    sys.exit()
    return


def main():
    filename=""
    global output_database
    try:
        opts,args = getopt.getopt(sys.argv[1:],'hi:o:',["help","input=","output="])
    except getopt.GetoptError:
        print 'please input -h or --help'
        sys.exit()


    for key,value in opts:
        if key in ("-h","--help"):
            usage()
        if key in ("-i","--input"):
            filename = value
        if key in ("-o","--output"):
            output_database = value
    pcaps = rdpcap(filename)
    tcp_parse(pcaps)
    udp_parse(pcaps)
    icmp_parse(pcaps)
    ip_parse(pcaps)
    return


if __name__ == '__main__':
    main()

帮助说明：

处理结果：