SoCo/SoCo — pull request #46 by KennethNielsen (2013-11-09 22:40:19+00:00)
Title: Ws analysis tool

This is the second iteration of the pull request (#40) for this tool to analyze the network traffic dumps concerning SoCo traffic. I closed the first pull request to fix a few problems and I think they should now fixed and the tool should be usable. Pasted below is the message from the description from the first pull request.

After being send a Wireshark dump file and finding it a less that enjoyable task to try and figure out what communication was actually in it I decided to write a small development tool to help with this task.

Given that you export the Wireshark content to a specific format of Wireshark dump (see the --help), the script will do the following:
* parse the dump and stitch the UPnP communication chunks together
* take all the parts of "inner XML" and interpret that as XML and reintegrate it for easier reading (to make sure that the reader will not misunderstand and think it is a part of the original XML, the script also offers a --external-inner-xml mode, that will show the inner XML separately)
* format all the XML in a readable indented manner
* show you these chunks syntax highlighted in the terminal in an interactive mode
* with the option to save a particularly interesting chunk to a file
* and/or open it in a browser, where the XML can be read syntax highlighted
* optionally in script mode, export all chunks to files and/or open them in a browser

The work contains several commits as I have been working on it for a while. I suggest to review the thing as a whole, since the individual chunks does not represent well defined chunks of work.

An obvious caveat is cross platform support. I wrote the script in Linux, so it works on Linux. The most obvious caveat is that color syntax highlighting is disabled on windows, since I don't think the Windows terminal support ANSI color codes. If I am wrong it can be enabled manually with a command line argument. (I did consider using curses, but it was to much work). (EDIT As it turn out the Windows support for scapy is not very good at the moment, which in practice excludes the tool from being used on Windows. Let's hope it changes in the future.)

I have made a few bits of cross platform support, but not all of them. Everything else than colors should be trivial and I would be happy to point someone in the direction of the few changes that need to be made, to make it purr on Windows, but I would rather not implement it blindly (without the option to test) myself. Colors might take a lot of work.

Let me know what you think.