Skip to content

Instantly share code, notes, and snippets.

@nextime
Created April 23, 2021 15:05
Show Gist options
  • Save nextime/f0372203a29df83ccbf52ed87e550c0e to your computer and use it in GitHub Desktop.
Save nextime/f0372203a29df83ccbf52ed87e550c0e to your computer and use it in GitHub Desktop.
#!/usr/bin/python3
from setproctitle import setproctitle
from shell_cmd import sh
from nfstream import NFStreamer
import time
setproctitle("dpi")
online_streamer = NFStreamer(source="br0", promiscuous_mode=False, splt_analysis=20, statistical_analysis=False)
Names = {
'DNS': 'dns',
'Web': 'web',
}
Categories = {
'SocialNetwork': 'socialnet',
'DNS': 'dns'
}
Already=[]
class NexDPI():
def __init__(self):
print(time.asctime(), "NexDPI created")
def main(self):
print(time.asctime(), "NexDPI started")
for flow in online_streamer:
#print(time.asctime()+" "+flow.application_name) # print it.from nfstream import NFStreamer
#print(time.asctime()+" "+flow.application_category_name)
fullname=flow.application_name+"_"+flow.application_category_name
if not fullname in Already:
print(time.asctime(), "NEWRECORD:", fullname)
Already.append(fullname)
if flow.application_category_name=='SocialNetwork' and not flow.application_name.startswith('DNS.'):
triplet=str(flow.dst_ip)+","+str(flow.dst_port)+","+str(flow.src_ip)
print(time.asctime(), sh("ipset test social_triplet "+triplet+" || ipset add social_triplet "+triplet+" timeout 3600"))
#print(flow.application_is_guessed)
#print(flow.src_ip)
#print(flow.src_port)
#print(flow.dst_ip)
#print(flow.dst_port)
#print(flow.requested_server_name)
print("############################################")
time.sleep(0.1)
if __name__ == "__main__":
import sys
ndpi=NexDPI()
ndpi.main()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment