Package: pdml2flow
Aggregates wireshark pdml to flows, with pluginsWhen analyzing network traffic, it is sometimes helpful to group
captured frames. For example by port numbers to obtain network flows or
using MAC addresses for hardware flows. Doing this inWiresharkortsharkis
difficult.pdml2flowwas designed to solve this use case.pdml2flowreadstsharkoutput
using thePacket Description Markup
Languageand writes flows either in
JSON or XML. These flows are also accessible from a python plugin
interface. If flow aggregation is not needed,pdml2framecan be be
used to processpdmlwith plugins.BranchBuildCoveragemasterdevelopPrerequisitespython:3.43.53.5-dev3.63.6-dev3.7-devnightlypipInstallation$sudopipinstallpdml2flowUsage$pdml2flow-husage:pdml2flow[-h][--version][-fFLOW_DEF_STR][-tFLOW_BUFFER_TIME][-lDATA_MAXLEN][-c][-a][-s][-d][+json[args]][+xml[args]]Aggregateswiresharkpdmltoflowsoptionalarguments:-h,--helpshowthishelpmessageandexit--versionPrintversionandexit-fFLOW_DEF_STRFieldswhichdefinetheflow,nestingwith:'.'[default:['vlan.id','ip.src','ip.dst','ipv6.src','ipv6.dst','udp.stream','tcp.stream']]-tFLOW_BUFFER_TIMELenght(inseconds)tobufferaflowbeforewritingthepackets[default:180]-lDATA_MAXLENMaximumlenghtofdataintsharkpdml-field[default:200]-cRemovesduplicatedatawhenmergingobjects,willnotpreserveorderofleaves[default:False]-aInsteadofmergingtheframeswillappendthemtoanarray[default:False]-sExtractshownames,everydataleafwillnowlooklike{raw:[],show:[]}[default:False]-dDebugmode[default:False]Plugins:+json[args]usage:JSONoutput[-h][-0]optionalarguments:-h,--helpshowthishelpmessageandexit-0Terminateslineswithnullcharacter+xml[args]usage:XMLoutput[-h][-0]optionalarguments:-h,--helpshowthishelpmessageandexit-0TerminateslineswithnullcharacterEnvironment VariablesNameDescriptonLOAD_PLUGINSIf set toFalse, skips loading of all pluginsExamplesSniff from interface and write json:$tshark-iinterface-Tpdml|pdml2flow+jsonRead a .pcap file$tshark-rpcap_file-Tpdml|pdml2flow+jsonAggregate based on ethernet source and ethernet destination address$tshark-iinterface-Tpdml|pdml2flow-feth.src-feth.dst+jsonPretty print flows usingjq$tshark-iinterface-Tpdml|pdml2flow+json|jqPost-process flows usingFluentFlow$tshark-iinterface-Tpdml|pdml2flow+json|fluentflowrules.jsPluginselasticsearch:
Saves pdml2flow output in Elasticsearchbase64-strings:
Extract strings encoded in base64frame-inter-arrival-time:
Calculate frame inter arrival timespdml2flow/plugins/: Plugins shipped by
defaultInterface# vim: set fenc=utf8 ts=4 sw=4 et :classPlugin2(object):# pragma: no cover"""Version 2 plugin interface."""@staticmethoddefhelp():"""Return a help string."""passdef__init__(self,*args):"""Called once during startup."""passdef__deinit__(self):"""Called once during shutdown."""passdefflow_new(self,flow,frame):"""Called every time a new flow is opened."""passdefflow_expired(self,flow):"""Called every time a flow expired, before printing the flow."""passdefflow_end(self,flow):"""Called every time a flow ends, before printing the flow."""passdefframe_new(self,frame,flow):"""Called for every new frame."""passCreate a New PluginUtilsThe following utils are part of this projectpdml2frameWireshark pdml to frames, with plugins$pdml2frame-husage:pdml2frame[-h][--version][-s][-d][+json[args]][+xml[args]]Convertswiresharkpdmltoframesoptionalarguments:-h,--helpshowthishelpmessageandexit--versionPrintversionandexit-sExtractshownames,everydataleafwillnowlooklike{raw:[],show:[]}[default:False]-dDebugmode[default:False]Plugins:+json[args]usage:JSONoutput[-h][-0]optionalarguments:-h,--helpshowthishelpmessageandexit-0Terminateslineswithnullcharacter+xml[args]usage:XMLoutput[-h][-0]optionalarguments:-h,--helpshowthishelpmessageandexit-0TerminateslineswithnullcharacterTestingTest documentationrunning the tests:$pythonsetup.pytest