[Python] Visualize the information acquired by Wireshark

Visualize the information acquired by Wireshark

Introduction

It's fine if it's only packets generated on localhost, but when port forwarding is done, Wireshark gets messed up and it's hard to understand, so I tried to visualize it.

This time we are only dealing with packets that occur on localhost, but we are using PageRank (visualize the importance of the node) for those who are getting multiple packets.

environment

Python 3.7.5

Preparation

Install Python package

pip install dpkt
pip install networkx
pip install matplotlib

Export the data captured by Wireshark

Please save the file captured by Wireshark as it will be used. Select .pcap ofWireshark / tcpdump / ...as the file format to save.

Completed form

The IP address has been corrected for the time being.

How to use

It is assumed that both are in the same hierarchy.

python pcap_Visualization.py <file name.pcap>

Source code

pcap_Visualization.py

import binascii
import dpkt
import matplotlib.pyplot as plt
import networkx as nx
import os
import socket
import string
import sys


def main(file_name):
    packet_count = 0
    pcr = dpkt.pcap.Reader(open(file_name,'rb'))

    #Packet processing
    for ts,buf in pcr:
        packet_count += 1
        try:
            eth = dpkt.ethernet.Ethernet(buf)
        except:
            continue

        #For IP data
        if type(eth.data) == dpkt.ip.IP:
            ip = eth.data
            src = socket.inet_ntoa(ip.src)
            dst = socket.inet_ntoa(ip.dst)
            with open('./edgelist.txt', 'a') as f:
                print("{} {}".format(src, dst), file = f)

    G = nx.read_edgelist('edgelist.txt', nodetype=str)  #File reading
    plt.figure(figsize=(7, 7))
    pos = nx.spring_layout(G)

    #Add PageRank
    pr = nx.pagerank(G)
    nx.draw_networkx_edges(G, pos, edge_color='y')

    #node_Include PageRank value in size
    nx.draw_networkx_nodes(
        G,
        pos,
        node_color='r',
        alpha=0.5,
        node_size=[5000*v for v in pr.values()]
    )
    nx.draw_networkx_labels(
        G,
        pos,
        font_size=10
    )

    plt.axis('off')
    plt.show()

    os.remove("edgelist.txt")
    print("Processing Exit:{}".format(packet_count))

#Main function
if __name__ == '__main__':
    if (len(sys.argv) != 2):
        print("Please specify the file")
        exit()
    #Set the second argument to the file name
    file_name = sys.argv[1]

    main(file_name)

bonus

When I added packets generated by other devices, it looked like this! It's hard to tell the difference between PageRank ... I'll fix it when I feel like it!

Summary

NetworkX is interesting !! It's a package that expresses the connection between nodes and edges, but it seems that it can be applied to other than networks !! We look forward to your suggestions !!