compare tcp pcaps

compare_tcp.py

import pandas as pd
import os,sys
from tcp_pcap2h5 import open_pcap



def main(pcap1,pcap2):
    open_pcap(pcap1)
    open_pcap(pcap2)
    h5name1 = pcap1+'.h5'
    h5name2 = pcap2+'.h5'
    store1 = pd.HDFStore(h5name1)
    store2 = pd.HDFStore(h5name2)
    dat01 = store1['pcap_data']
    dat02 = store2['pcap_data']
    store1.close()
    store2.close()
    dat01['our_seq'] = map(lambda x: x[0],dat01.pkt_data.str.split(','))
    dat02['our_seq'] = map(lambda x: x[0],dat02.pkt_data.str.split(','))
    ndat01 = dat01[dat01.frame_len>=388]
    ndat02 = dat02[dat02.frame_len>=388]
    ndat01['timestamp'] = ndat01.index
    ndat02['timestamp'] = ndat02.index
    ndat01.index = ndat01.our_seq
    ndat02.index = ndat02.our_seq
    joined = ndat01.join(ndat02,lsuffix='01',rsuffix='02')
    joined['ns_diff'] = (joined.timestamp01 - joined.timestamp02).astype(float)
    joined.index = joined.index.values.astype(long)
    print joined.ns_diff.describe()

if __name__ == "__main__":
    if len(sys.argv) != 3:
        sys.exit('Usage: %s pcap1 pcap2' % sys.argv[0])

    if not os.path.exists(sys.argv[1]):
        sys.exit('ERROR: Raw h5 file %s was not found!' % sys.argv[1])
    if not os.path.exists(sys.argv[2]):
        sys.exit('ERROR: Raw h5 file %s was not found!' % sys.argv[1])
    sys.exit(main(sys.argv[1],sys.argv[2]))