read_tcp_packets.py

import struct
import sys
import socket
import platform
from struct import * 
from struct import unpack
from contextlib import contextmanager
import pymysql


#db
# Create a connection object
# IP address of the MySQL database server
Host = ""  
# User name of the database server
User = ""       
# Password for the database user
Password = ""           
  
database = ""
  
conn  = pymysql.connect(host=Host, user=User, password=Password, database=database)
cur  = conn.cursor()
     
#details
un = platform.system()
if un != "Linux":
    print(un + 'is not supported!')
    sys.exit(1)

@contextmanager
def create_socket():
    ''' Create a TCP raw socket '''
    s = socket.socket(socket.AF_INET,
                      socket.SOCK_RAW,
                      socket.IPPROTO_TCP)
    try:
        yield s
    finally:
        s.close()

try:
    with create_socket() as s:
        while True:
            pkt, addr = s.recvfrom(65535)

            # the first 20 bytes are ip header
            iphdr = unpack('!BBHHHBBH4s4s', pkt[0:20])
            iplen = (iphdr[0] & 0xf) * 4
            ttl = iphdr[5]
            s_addr = socket.inet_ntoa(iphdr[8])
            d_addr = socket.inet_ntoa(iphdr[9])
            # the next 20 bytes are tcp header
            tcphdr = unpack('!HHLLBBHHH', pkt[iplen:iplen+20])
            s_port = tcphdr[0]
            d_port = tcphdr[1]

            if not s_addr == "127.0.0.1" and d_port == 80:
                query = f"INSERT INTO client_info (source_ip, source_port, ttl_value) VALUES ('{s_addr}', {s_port}, {ttl});"
                print(query)
                cur.execute(query)
                conn.commit()
                
except KeyboardInterrupt:
    conn.close()
    pass