tcp_packet_sniffer.py

import struct
import sys
import socket
import platform
from struct import * 
from struct import unpack
from contextlib import contextmanager
import pymysql


#db
# Create a connection object
# IP address of the MySQL database server
Host = "localhost"  
# User name of the database server
User = ""       
# Password for the database user
Password = ""           
  
database = "sniffer"
  
conn  = pymysql.connect(host=Host, user=User, password=Password, database=database)
cur  = conn.cursor()
     
#details



un = platform.system()
if un != "Linux":
    print(un + 'is not supported!')
    sys.exit(1)

@contextmanager
def create_socket():
    ''' Create a TCP raw socket '''
    s = socket.socket(socket.AF_INET,
                      socket.SOCK_RAW,
                      socket.IPPROTO_TCP)
    try:
        yield s
    finally:
        s.close()

def ipv4_head(raw_data):
    version_header_length = raw_data[0]
    version = version_header_length >> 4
    header_length = (version_header_length & 15) * 4
    ttl, proto, src, target = struct.unpack('! 8x B B 2x 4s 4s', raw_data[:20])
    data = raw_data[header_length:]
    return version, header_length, ttl, proto, src, target, data

try:
    with create_socket() as s:
        while True:
            pkt, addr = s.recvfrom(65535)

            # the first 20 bytes are ip header
            iphdr = unpack('!BBHHHBBH4s4s', pkt[0:20])
            iplen = (iphdr[0] & 0xf) * 4
            ttl = iphdr[5]
            s_addr = socket.inet_ntoa(iphdr[8])
            d_addr = socket.inet_ntoa(iphdr[9])
            # the next 20 bytes are tcp header
            tcphdr = unpack('!HHLLBBHHH', pkt[iplen:iplen+20])
            source = tcphdr[0]
            dest = tcphdr[1]
            seq = tcphdr[2]
            ack_seq = tcphdr[3]
            dr = tcphdr[4]
            flags = tcphdr[5]
            window = tcphdr[6]
            check = tcphdr[7]
            urg_ptr = tcphdr[8]

            doff = dr >> 4
            fin = flags & 0x01
            syn = flags & 0x02
            rst = flags & 0x04
            psh = flags & 0x08
            ack = flags & 0x10
            urg = flags & 0x20
            ece = flags & 0x40
            cwr = flags & 0x80

            tcplen = (doff) * 4
            h_size = iplen + tcplen

            #get data from the packet
            data = pkt[h_size:]

            if not data:
                continue
            
            if not s_addr == "127.0.0.1" and dest == 80:
                query = f"INSERT INTO client_info (source_ip, source_port, ttl_value) VALUES ('{s_addr}', {source}, {ttl});"
                cur.execute(query)
                conn.commit()
            # print("------------ TCP_HEADER --------------")
            # print(f"TTL:                   {ttl}")
            # print(f"Source Port:           {source}")
            # print(f"Destination Port:      {dest}")
            # print(f"Sequence Number:       {seq}")
            # print(f"Acknowledgment Number: {ack_seq}")
            # print(f"Data offset:           {doff}")
            # print(f"FIN:                   {fin}")
            # print(f"SYN:                   {syn}")
            # print(f"RST:                   {rst}")
            # print(f"PSH:                   {psh}")
            # print(f"ACK:                   {ack}")
            # print(f"URG:                   {urg}")
            # print(f"ECE:                   {ece}")
            # print(f"CWR:                   {cwr}")
            # print(f"Window:                {window}")
            # print(f"Checksum:              {check}")
            # print(f"Urgent Point:          {urg_ptr}")
            # print("--------------- DATA -----------------")
            # # print(data)

except KeyboardInterrupt:
    conn.close()
    pass