@@ -0,0 +1,2748 @@
+#!/usr/bin/env python%0A# Copyright (c) 2006, Neville-Neil Consulting%0A# All rights reserved.%0A#%0A# Redistribution and use in source and binary forms, with or without%0A# modification, are permitted provided that the following conditions are%0A# met:%0A#%0A# Redistributions of source code must retain the above copyright notice,%0A# this list of conditions and the following disclaimer.%0A#%0A# Redistributions in binary form must reproduce the above copyright%0A# notice, this list of conditions and the following disclaimer in the%0A# documentation and/or other materials provided with the distribution.%0A#%0A# Neither the name of Neville-Neil Consulting nor the names of its %0A# contributors may be used to endorse or promote products derived from %0A# this software without specific prior written permission.%0A#%0A# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS%0A# %22AS IS%22 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT%0A# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR%0A# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT%0A# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,%0A# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT%0A# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,%0A# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY%0A# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT%0A# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE%0A# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.%0A#%0A# File: $Id: $%0A#%0A# Author: George V. Neville-Neil%0A#%0A# Description: Walk through an entire pcap dump file and give out%0A# information along the lines of netstat(1) on FreeBSD.%0A%0Aimport pcs%0Afrom pcs.packets.udp import *%0Afrom pcs.packets.tcp import *%0Afrom pcs.packets.ipv4 import *%0Afrom pcs.packets.ethernet import *%0Afrom pcs.packets.arp import *%0Aimport pcs.packets.ethernet as ethernet%0Aimport pcs.packets.arp as arp%0A%0Aimport sys%0A%0Adef main():%0A%0A    file = pcs.PcapConnector(%22fxp0%22)%0A%0A    # Construct a filter chain. we are only interested in 3 fields.%0A    a = ethernet.ethernet() / arp.arp()%0A    a.wildcard_mask()%0A    a.packets%5B0%5D.wildcard_mask(%5B%22type%22%5D, False)%0A    a.packets%5B1%5D.wildcard_mask(%5B%22pro%22, %22op%22%5D, False)%0A    a.packets%5B1%5D.pro = 0x0800%09# ETHERTYPE_IP (default)%0A    a.packets%5B1%5D.op = 1%09%09# ARPOP_REQUEST%0A%0A    print %22Waiting 10 seconds to see an ARP query.%22%0A    try:%0A        file.expect(%5Ba%5D, 10)%0A    except pcs.TimeoutError:%0A        print %22Timed out.%22%0A        sys.exit(1)%0A%0A    print %22And the matching packet chain is:%22%0A    print file.match%0A    sys.exit(0)%0A%0A    #  TODO: Add the ability to match more complex filters%0A    #        e.g. ar_spa == ar_tpa which is gratuitous arp.%0A%0Amain()%0A

Add a simple demo of the "expect" function.