Callback function called from the apply_on_packets function. Args: packet: Packet live captured by pyshark honeypot_events_queue: multiprocessing queue for storing honeypot events network_events_queue: multiprocessing queue for storing network events
(packet, honeypot_events_queue, network_events_queue)
| 69 | |
| 70 | |
| 71 | def process_packet(packet, honeypot_events_queue, network_events_queue): |
| 72 | """ |
| 73 | Callback function called from the apply_on_packets function. |
| 74 | |
| 75 | Args: |
| 76 | packet: Packet live captured by pyshark |
| 77 | honeypot_events_queue: multiprocessing queue for storing honeypot events |
| 78 | network_events_queue: multiprocessing queue for storing network events |
| 79 | """ |
| 80 | # set machine name |
| 81 | machine_name = network_configuration()["real_machine_identifier_name"] |
| 82 | |
| 83 | try: |
| 84 | # Check if packet contains IP layer |
| 85 | if "IP" in packet: |
| 86 | ip_dest = packet.ip.dst |
| 87 | ip_src = packet.ip.src |
| 88 | protocol = protocol_table[int(packet.ip.proto)] |
| 89 | port_dest = int() |
| 90 | port_src = int() |
| 91 | |
| 92 | # Check packet protocol and if it contains a layer with the same |
| 93 | # name |
| 94 | if protocol == "TCP" and "TCP" in packet: |
| 95 | port_dest = int(packet.tcp.dstport) |
| 96 | port_src = int(packet.tcp.srcport) |
| 97 | |
| 98 | elif protocol == "UDP" and "UDP" in packet: |
| 99 | port_dest = int(packet.udp.dstport) |
| 100 | port_src = int(packet.udp.srcport) |
| 101 | if netaddr.valid_ipv4(ip_dest) or netaddr.valid_ipv6(ip_dest): |
| 102 | # ignored ip addresses and ports in python - fix later |
| 103 | # check if the port is in selected module |
| 104 | insert_to_honeypot_events_queue( |
| 105 | HoneypotEvent( |
| 106 | ip_dest, |
| 107 | port_dest, |
| 108 | ip_src, |
| 109 | port_src, |
| 110 | protocol, |
| 111 | honeypot_ports[port_dest if port_dest in honeypot_ports.keys() else port_src], |
| 112 | machine_name |
| 113 | ), |
| 114 | honeypot_events_queue |
| 115 | ) if port_dest in honeypot_ports.keys() or port_src in honeypot_ports \ |
| 116 | else insert_to_network_events_queue( |
| 117 | NetworkEvent( |
| 118 | ip_dest, |
| 119 | port_dest, |
| 120 | ip_src, |
| 121 | port_src, |
| 122 | protocol, |
| 123 | machine_name |
| 124 | ), |
| 125 | network_events_queue |
| 126 | ) |
| 127 | |
| 128 | except Exception as _e: |
no test coverage detected