https://github.com/OpenSOC/pycapa

Python Packet Capture
https://github.com/OpenSOC/pycapa

Last synced: 13 days ago
JSON representation

Python Packet Capture

• Host: GitHub
• URL: https://github.com/OpenSOC/pycapa
• Owner: OpenSOC
• License: apache-2.0
• Created: 2015-01-16T18:44:06.000Z (almost 10 years ago)
• Default Branch: master
• Last Pushed: 2015-01-16T21:27:19.000Z (almost 10 years ago)
• Last Synced: 2024-08-01T20:38:22.893Z (3 months ago)
• Language: Python
• Size: 133 KB
• Stars: 10
• Watchers: 29
• Forks: 6
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# Pycapa

## Overview

Pycapa is an open source tool to handle packet capture ingestion for [OpenSOC](https://github.com/opensoc/opensoc-streaming). It is intended as a testing and development tool. It is not performant enough for production operations. The tool will capture packets from a specified interface and push them into a Kafka Topic in a format understandable by OpenSOC's PcapParserBolt.

## Requirements

* [Scapy](http://www.secdev.org/projects/scapy/)

* [kurator](https://github.com/tpiscitell/kurator)

## Installation

First install the required packages with pip:

    

    pip install -r requirements.txt

Then install pycapa:

    python setup.py install

## Usage

    usage: pycapa.py [-h] [-t TOPIC] [-z ZOOKEEPER] [-l] [-d] -i INTERFACE

    optional arguments:

      -h, --help            show this help message and exit

      -t TOPIC, --topic TOPIC

                            topic to produce to

      -z ZOOKEEPER, --zookeeper ZOOKEEPER

                            zookeeper server

      -l, --local           print packet instead of send to kafka

      -d, --debug           enable debug messages

      -i INTERFACE, --interface INTERFACE

                            interface to listen on

## Kafka Message Format

Each kafka message corresponds to a single packet capture from the wire. A kafka message can be thought of as a single packet [libpcap](http://wiki.wireshark.org/Development/LibpcapFileFormat) capture file. It contains the Global Header, the Packet Header, and the packet data.