https://github.com/intake/intake-pcap
https://github.com/intake/intake-pcap
Last synced: 9 months ago
JSON representation
- Host: GitHub
- URL: https://github.com/intake/intake-pcap
- Owner: intake
- License: bsd-2-clause
- Created: 2017-12-13T20:42:01.000Z (over 8 years ago)
- Default Branch: master
- Last Pushed: 2020-02-06T14:33:40.000Z (over 6 years ago)
- Last Synced: 2024-05-08T20:04:07.257Z (about 2 years ago)
- Language: Python
- Size: 112 KB
- Stars: 2
- Watchers: 6
- Forks: 4
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Intake PCAP Plugin
[](https://travis-ci.org/ContinuumIO/intake-pcap)
[](http://intake-pcap.readthedocs.io/en/latest/?badge=latest)
This plugin is for the [Intake data loader library](http://intake.readthedocs.io/en/latest/).
### Installation
While `requirements.txt` contains the package dependencies, we currently need to
install a mixture of conda and pip packages. The install instructions are:
```
conda install -c intake intake
conda install libpcap
pip install pcapy
python setup.py develop
```
### Examples
To bootstrap a sample PCAP file, run the following given your local network
interface (macOS is `en0`, Linux is `eth0`) and a sample size of packets:
```
sudo python examples/dump-live.py examples/local.pcap en0 100
```
NOTE: If you output to `examples/local.pcap`, the provided catalog,
`sample.yml`, will be able to read this.
To read a live stream, run the following with an optional protocol filter
(valid values are `tcp`, `udp`, `icmp`, and `igmp`):
```
sudo python examples/read-live.py INTERFACE [PROTOCOL]
```
To read a local PCAP file, run the following with an optional protocol filter
(valid values are `tcp`, `udp`, `icmp`, and `igmp`):
```
sudo python examples/read-pcap.py PATH [PROTOCOL]
```
To read a catalog source, run the following with a valid name (`local` reads
PCAP file, `raw_live` reads Ethernet packets from default macOS network,
`udp_live` reads UDP packets from default macOS network):
```
sudo python examples/read-source.py examples/sample.yml NAME
```