Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Load a PCAP into neo4j with scapy
#!/usr/bin/env python3
from scapy.all import *
from py2neo import Graph, Node, Relationship
packets = rdpcap("<your_pcap_file>")
g = Graph(password="<your_neo4j_password>")
for packet in packets.sessions():
pkt = packet.split()
if "TCP" in pkt[0]:
a = Node("Host", name=pkt[1].split(":")[0])
b = Node("Host", name=pkt[3].split(":")[0])
SENDtcp = Relationship.type("TCP")
g.merge(SENDtcp(a, b), "Host", "name")
elif "UDP" in pkt[0]:
a = Node("Host", name=pkt[1].split(":")[0])
b = Node("Host", name=pkt[3].split(":")[0])
SENDudp = Relationship.type("UDP")
g.merge(SENDudp(a, b), "Host", "name")
elif "ICMP" in pkt[0]:
a = Node("Host", name=pkt[1].split(":")[0])
b = Node("Host", name=pkt[3].split(":")[0])
SENDicmp = Relationship.type("ICMP")
g.merge(SENDicmp(a, b), "Host", "name")
elif "ARP" in pkt[0]:
a = Node("Host", name=pkt[1].split(":")[0])
b = Node("Host", name=pkt[3].split(":")[0])
SENDarp = Relationship.type("ARP")
g.merge(SENDarp(a, b), "Host", "name")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment