Package: netdumplings
A framework for distributed network packet sniffing and processing.See thedocumentationfor more details, and thenetmomoandpackscapesample Web applications (dumpling eaters) which use netdumplings as their
back-end. Python 3.7 or higher is required. It has been tested with Python 3.8
on OS X 10.15 and Windows 10.Installationpip install netdumplingsThis should be enough for Linux and OS X. On Windows you may also need toinstall Npcap.Distributed packet sniffing?netdumplings allows you to run multiple packet sniffers on any number of hosts.
Those sniffers – calleddumpling kitchens– pass any sniffed network
packets to your Python code for processing. Your Python code is implemented as
classes calleddumpling chefswhich use the network packets to generatedumplings. Dumpling contents are entirely up to you but they’ll usually
describe the information contained in the sniffed network packets.The dumplings created by the dumpling chefs are sent from the dumpling kitchens
to a singledumpling hub, which forwards them on to any connecteddumpling eatersfor display or for any other sort of processing or
visualization.Thekitchens,chefs,dumplings,hub, andeaters, are shown
below. You write the bits in green (the chefs and eaters) and netdumplings
does the rest:Dumplings are sent between the kitchens, hub, and eaters, over WebSockets.What does a dumpling look like?Dumplings are just JSON data. The following dumpling was created by a chef
which makes a dumpling for every DNS lookup.{"metadata":{"chef":"DNSLookupChef","creation_time":1515990765.925951,"driver":"packet","kitchen":"default_kitchen"},"payload":{"lookup":{"hostname":"myspace.com","when":1515990721.147}}}The"payload"section is generated by the dumpling chef and the"metadata"section is created automatically when the dumpling is sent to
the hub by the kitchen.Example dumpling chefThe following dumpling chef creates a dumpling for every DNS lookup (see the
example dumpling above).importtimeimportnetdumplingsclassDNSLookupChef(netdumplings.DumplingChef):defpacket_handler(self,packet):# The incoming packet is a scapy packet object.# https://scapy.readthedocs.io# Ignore packets that we don't care about.ifnotpacket.haslayer('DNS'):return# Determine the name of the host that was looked up.dns_query=packet.getlayer('DNS')query=dns_query.fields['qd']hostname=query.qname.decode('utf-8')# Generate a dumpling payload from the DNS lookup.dumpling_payload={'lookup':{'hostname':hostname,'when':time.time(),}}# The handler is returning a dict, which will be automatically# converted into a dumpling and sent to nd-hub, which will then# forward it on to all the eaters.returndumpling_payloadExample dumpling eaterThe following eater prints the payload of every dumpling sent fromnd-hub.importjsonimportnetdumplingsclassPrinterEater(netdumplings.DumplingEater):asyncdefon_connect(self,hub_uri,websocket):print(f'Connected to nd-hub at{hub_uri}')print('Waiting for dumplings...\n')asyncdefon_dumpling(self,dumpling):# The given dumpling is a netdumplings.Dumpling instance.dumpling_printable=json.dumps(dumpling.payload,indent=4)print(f'{dumpling_printable}\n')defdumpling_printer():eater=PrinterEater()eater.run()if__name__=='__main__':dumpling_printer()More informationSee thedocumentationfor more details.