两年前为了更好验证正确性，刚摸PERL，写的一个数据包分析脚本，整体还是比较弱的，缺少了perl的任性
这个脚本优点有：
1：基本能将wireshark的命令行程序tshark的所有用法都揽括在内了，再也不用担心不会命令了
2：离线能够分析链路层，IP层，TCP层以及HTTP层的相关信息，并以文件方式储存起来
3：由于输入是一个文件列表，所以可以一次性处理多个数据包文件，每个文件信息分开储存起来
4：多线程执行，每个线程执行一个tshark进程
5：设置CPU亲和性，进程单独绑核，可惜的是在两CPU，16核心的sandy bridge服务器上，设置了CPU Affinity处理性能还没有系统分配CPU的性能好，侧面也说明程序写得不太好
6：相对而言，基于tshark，和wireshark基本一致，准确性稍显可靠
7：扩展性还好，需要多一个分析域，只要添加一个线程，调用tshark命令即可
缺点：
1：最弱的地方大部分都是由正则表达式获取信息，显然性能就弱了一大截，由于最开始没这么多信息，都是一个一个添加的，尽管命令都是通过管道执行，但是改成split方式获取数据性能应该更好
2：多线程虽然能提高很多性能（大概3/4），但每个线程都是调用的同一个应用程序tshark执行进程
3：命令的完全正确性值得探讨，比如TCP的乱序和重传，很多肯定会不完整，有残缺
4：有的流量是需要测试某些特定流量要求计算的
5：整个程序不美观，比较弱，因为都是一个又一个独立的函数，总感觉少了点什么
#!/usr/bin/perl
##########################################
#http_parser.pl
#input:
# trace file list
#output:
# L2, L3, L4, L7 information
#require:
# tshark
#2013-10-21 HuiLi
##########################################
use threads;
#use Sys::CpuAffinity;
use Term::ANSIColor;
sub Get_pcap {
my $pcap_path_file = shift;
my $pcap_file;
if($pcap_path_file =~ /.*\/(.*)/){
$pcap_file = $1;
}
else {
$pcap_file = $pcap_path_file;
}
return $pcap_file;
}
sub Ports_traffic {
my ($four_trace_file, $four_parser_pf, $Pretty) = @_;
my %ports_traffic;
my $ports;
my $traffic;
my $total_traffic;
open $PORT, "tshark -r $four_trace_file -T fields -e tcp.port -e frame.len |";
while(<$PORT>){
if(/(\d+),(\d+)\s+(\d+)/){
$srcports = $1;
$dstports = $2;
$ports_traffic{$srcports} += $3;
$ports_traffic{$dstports} += $3;
$total_traffic += $3;
}
}
close($PORT);
foreach my $key (sort { $ports_traffic{$b} <=> $ports_traffic{$a} } keys %ports_traffic ){
my $traffic_rate = $ports_traffic{$key} * 100 / $total_traffic;
print $four_parser_pf "dst_port $key : $ports_traffic{$key} => $traffic_rate% \n";
}
$Pretty->("Ports-Traffic");
}
sub Four_tuple {
my ($four_trace_file, $four_parser_pf, $Pretty) = @_;
my %src_ip;
my %dst_ip;
my %src_pt;
my %dst_pt;
my @srcip;
my @dstip;
my @srcpt;
my @dstpt;
my $srcip_number = 0;
my $dstip_number = 0;
my $srcpt_number = 0;
my $dstpt_number = 0;
open $FOUR, "tshark -r $four_trace_file -T fields -e tcp.srcport -e tcp.dstport -e ip.src -e ip.dst |";
while(<$FOUR>){
if(/(\d+)\s+(\d+)\s+(\d+\.\d+\.\d+\.\d+)\s+(\d+\.\d+\.\d+\.\d+)/){
push @srcpt, $1;
push @dstpt, $2;
push @srcip, $3;
push @dstip, $4;
}
}
++$src_ip{$_} for(@srcip);
++$srcip_number foreach (keys %src_ip);
++$dst_ip{$_} for(@dstip);
++$dstip_number foreach (keys %dst_ip);
++$src_pt{$_} for(@srcpt);
++$srcpt_number foreach (keys %src_pt);
foreach my $src_port (keys %src_pt) {
print $four_parser_pf "src_port $src_port : $src_pt{$src_port}\n";
}
++$dst_pt{$_} for(@dstpt);
++$dstpt_number foreach (keys %dst_pt);
foreach my $dst_port (keys %dst_pt) {
print $four_parser_pf "dst_port $dst_port : $dst_pt{$dst_port}\n";
}
close($FOUR);
print $four_parser_pf "src_ipaddr : $srcip_number\n";
$Pretty->("Src-IPAddr");
print $four_parser_pf "dst_ipaddr : $dstip_number\n";
$Pretty->("Dst-IPAddr");
print $four_parser_pf "src_port : $srcpt_number\n";
$Pretty->("Src-Port");
print $four_parser_pf "dst_port : $dstpt_number\n";
$Pretty->("Dst-Port");
}
sub Frame {
my ($L2_trace_file, $L2_parser_pf, $Pretty) = @_;
my $L2_frame_number = 0;
my $L2_frame_length = 0;
my $L2_ave_frame_length = 0;
my $frame_length = 0;
my $max_frame_length = 0;
my $max_frame_number = 0;
my $long_frame_number = 0;
my $frame_pid = 0;
$frame_pid = open $TSHARK_L2, "tshark -r $L2_trace_file -T fields -e frame.number -e frame.len |";
# Sys::CpuAffinity::setAffinity($frame_pid, [2]);
# @cpus = Sys::CpuAffinity::getAffinity($frame_pid);
# print @cpus;
while(<$TSHARK_L2>){
($L2_frame_number, $frame_length) = split /\s+/;
if($max_frame_length < $frame_length){
$max_frame_number = $L2_frame_number;
$max_frame_length = $frame_length;
}
# print $frame_number . " hello " . $frame_length . "\n";
$L2_frame_length += $frame_length;
++$long_frame_number if $frame_length > 1600;
}
# $L2_frame_number = $frame_number;
close($TSHARK_L2);
print $L2_parser_pf "total_frame_number : $L2_frame_number\n";
print $L2_parser_pf "total_frame_length : $L2_frame_length\n";
$L2_ave_frame_length = $L2_frame_length / $L2_frame_number;
print $L2_parser_pf "ave_frame_length : $L2_ave_frame_length\n";
print $L2_parser_pf "frame_length_>1600 : $long_frame_number\n";
print $L2_parser_pf "max_frame_length $max_frame_length : frame $max_frame_number\n";
$Pretty->("L2-Frame");
}
sub L7 {
my ($L7_trace_file, $L7_parser_pf, $Pretty) = @_;
my $trace_file = Get_pcap($L7_trace_file);
my $url_file = $trace_file . ".information/" . $trace_file . ".url";
my $host_file = $trace_file . ".information/" . $trace_file . ".host";
my $refer_file = $trace_file . ".information/" . $trace_file . ".refer";
my $method_file = $trace_file . ".information/" . $trace_file . ".method";
unlink $url_file if -f $url_file;
unlink $host_file if -f $host_file;
unlink $refer_file if -f $refer_file;
unlink $method_file if -f $method_file;
my $url;
my $method;
my $host;
my $uri;
my $refer;
my $max_url_frame = 0;
my $max_url_length = 0;
my $url_length = 0;
my $total_url_length = 0;
my $ave_url_length = 0;
my $url_number = 0;
my $url_length_100 = 0;
my $url_length_500 = 0;
my $url_length_1000 = 0;
my $url_length_2000 = 0;
my $url_length_long = 0;
my $L7_pid = 0;
$L7_pid = open $L7, "tshark -r $L7_trace_file -T fields -e frame.number -e http.request.method -e http.host -e http.request.uri -e http.referer|";
# Sys::CpuAffinity::setAffinity($L7_pid, [3, 4]);
open $URL_FILE, '>>', $url_file;
open $HOST_FILE, '>>', $host_file;
open $REFER_FILE, '>>', $refer_file;
open $METHOD_FILE, '>>', $method_file;
while(<$L7>){
($frame, $method, $host, $uri, $refer) = split /\s+/;
$url = $host . $uri;
print $METHOD_FILE "Frame $frame: $method\n" if $method;
print $HOST_FILE "Frame $frame: $host\n" if $host;
# ++$url_number and print $URL_FILE $url . "\n" if $url;
print $URL_FILE "Frame $frame: $url\n" if $url;
print $REFER_FILE "Frame $frame: $refer\n" if $refer;
$url_length = length $url;
$total_url_length += $url_length;
if ($url_length <= 100 && $url_length > 0){
++$url_length_100;
} elsif ($url_length > 100 && $url_length <= 500){
++$url_length_500;
} elsif ($url_length > 500 && $url_length <= 1000){
++$url_length_1000;
} elsif ($url_length > 1000 && $url_length <= 2000){
++$url_length_2000;
} elsif ($url_length > 2000){
++$url_length_long;
}
if ($max_url_length < $url_length){
$max_url_length = $url_length;
$max_url_frame = $frame;
}
}
close($L7);
close($URL_FILE);
close($REFER_FILE);
close($HOST_FILE);
close($METHOD_FILE);
$url_number = $url_length_100 + $url_length_500 + $url_length_1000 + $url_length_2000 + $url_length_long;
print $L7_parser_pf "url_number : $url_number\n";
$ave_url_length = $total_url_length / $url_number;
print $L7_parser_pf "max_url_length $max_url_length : frame $max_url_frame\n";
print $L7_parser_pf "ave_url_length : $ave_url_length\n";
print $L7_parser_pf "url_length 0~100 : $url_length_100\n";
print $L7_parser_pf "url_length 100~500 : $url_length_500\n";
print $L7_parser_pf "url_length 500~1000 : $url_length_1000\n";
print $L7_parser_pf "url_length 1000~2000 : $url_length_2000\n";
print $L7_parser_pf "url_length > 2000 : $url_length_long\n";
$Pretty->("L7-Url-Host-Refer");
}
sub IP_fragment {
my ($frag_trace_file, $frag_parser_pf, $Pretty) = @_;
my $frag_number = 0;
my @ip_fragment;
my $fragment_pid;
$fragment_pid = open $FRAGMENT, "tshark -r $frag_trace_file -T fields -e ip.fragment |";
# Sys::CpuAffinity::setAffinity($fragment_pid, [5]);
while(<$FRAGMENT>){
chomp;
@ip_fragment = split /,/;
$frag_number += @ip_fragment;
}
close($FRAGMENT);
print $frag_parser_pf "ip_fragment_number : $frag_number\n";
$Pretty->("IP-Fragment");
}
sub TCP_packet {
my ($tcp_frame_trace_file, $tcp_frame_parser_pf, $Pretty) = @_;
my $tcp_frame_number = 0;
open $TCP_FRAME, "tshark -r $tcp_frame_trace_file -T fields -e tcp |";
while(<$TCP_FRAME>){
++$tcp_frame_number if /Transmission Control Protocol/;
}
close($TCP_FRAME);
print $tcp_frame_parser_pf "tcp_packet_number : $tcp_frame_number\n";
$Pretty->("TCP-Packet");
}
sub UDP_packet {
my ($udp_frame_trace_file, $udp_frame_parser_pf, $Pretty) = @_;
my $udp_frame_number = 0;
open $UDP_FRAME, "tshark -r $udp_frame_trace_file -T fields -e udp |";
while(<$UDP_FRAME>){
++$udp_frame_number if /User Datagram Protocol/;
}
close($UDP_FRAME);
print $udp_frame_parser_pf "udp_packet_number : $udp_frame_number\n";
$Pretty->("UDP-Packet");
}
sub ICMP_packet {
my ($icmp_frame_trace_file, $icmp_frame_parser_pf, $Pretty) = @_;
my $icmp_frame_number = 0;
open $ICMP_FRAME, "tshark -r $icmp_frame_trace_file -T fields -e icmp |";
while(<$ICMP_FRAME>){
++$icmp_frame_number if /icmp/;
}
close($ICMP_FRAME);
print $icmp_frame_parser_pf "icmp_packet_number : $icmp_frame_number\n";
$Pretty->("ICMP-Packet");
}
sub TCP_out_of_order {
my ($out_trace_file, $out_parser_pf, $Pretty) = @_;
my $out_number = 0;
my $out_pid;
$out_pid = open $OUT, "tshark -r $out_trace_file -T fields -e tcp.analysis.out_of_order |";
# Sys::CpuAffinity::setAffinity($fragment_pid, [5]);
while(<$OUT>){
# chomp;
++$out_number if /1/;
}
close($OUT);
print $out_parser_pf "tcp_out_of_order : $out_number\n";
$Pretty->("TCP-Out-Of-Order");
}
sub TCP_retransmission {
my ($re_trace_file, $re_parser_pf, $Pretty) = @_;
my $re_number = 0;
my $re_pid;
$re_pid = open $RETRANSMISSION, "tshark -r $re_trace_file -T fields -e tcp.analysis.retransmission |";
# Sys::CpuAffinity::setAffinity($fragment_pid, [5]);
while(<$RETRANSMISSION>){
# chomp;
++$re_number if /1/;
}
close($RETRANSMISSION);
print $re_parser_pf "tcp_retransmission : $re_number\n";
$Pretty->("TCP-Retransmission");
}
sub HTTP_user_agent {
my ($agent_trace_file, $Pretty) = @_;
my $trace_file = Get_pcap($agent_trace_file);
my $agent_file = $trace_file . ".information/" . $trace_file . ".user_agent";
unlink $agent_file if -f $agent_file;
my $agent_frame_number = 0;
my $user_agent;
my $agent_pid = 0;
open my($AGENT_FILE), '>>', $agent_file;
$agent_pid = open my($AGENT), "tshark -r $agent_trace_file -T fields -e frame.number -e http.user_agent |";
# Sys::CpuAffinity::setAffinity($agent_pid, [6]);
while(<$AGENT>){
# print $USERAGENT $_. "\n";
if(/(\d+)\s+(.*)/){
$agent_frame_number = $1;
$user_agent = $2;
}
print $AGENT_FILE "Frame $agent_frame_number: $user_agent\n" if $user_agent;
}
close($AGENT);
close($AGENT_FILE);
$Pretty->("User-Agent");
}
sub HTTP_xforwarded_for {
my ($xforward_trace_file, $Pretty) = @_;
my $trace_file = Get_pcap($xforward_trace_file);
my $xforward_file = $trace_file . ".information/" . $trace_file . ".xforward";
unlink $xforward_file if -f $xforward_file;
my $xforward_frame_number = 0;
my $xforwarded_for;
my $xforward_pid = 0;
open my($XFORWARD_FILE), '>>', $xforward_file;
$xforward_pid = open my($XFORWARD), "tshark -r $xforward_trace_file -T fields -e frame.number -e http.x_forwarded_for |";
# Sys::CpuAffinity::setAffinity($xforward_pid, [7]);
while(<$XFORWARD>){
if(/(\d+)\s+(.*)/){
$xforward_frame_number = $1;
$xforwarded_for = $2;
}
print $XFORWARD_FILE "Frame $xforward_frame_number: $xforwarded_for\n" if $xforwarded_for;
}
close($XFORWARD);
close($XFORWARD_FILE);
$Pretty->("X-Forwarded-For");
}
sub HTTP_cookie {
my ($cookie_trace_file, $cookie_parser_pf, $Pretty) = @_;
my $trace_file = Get_pcap($cookie_trace_file);
my $cookie_file = $trace_file . ".information/" . $trace_file . ".cookie";
unlink $cookie_file if -f $cookie_file;
my $cookie_frame_number = 0;
my $cookie;
my $cookie_number = 0;
my $cookie_pid = 0;
open my($COOKIE_FILE), '>>', $cookie_file;
$cookie_pid = open my($COOKIE), "tshark -r $cookie_trace_file -T fields -e frame.number -e http.cookie |";
# Sys::CpuAffinity::setAffinity($cookie_pid, [8]);
while(<$COOKIE>){
if(/(\d+)\s+(.*)/){
$cookie_frame_number = $1;
$cookie = $2;
}
print $COOKIE_FILE "Frame $cookie_frame_number: $cookie\n" if $cookie;
++$cookie_number if $cookie;
}
close($COOKIE);
close($COOKIE_FILE);
print $cookie_parser_pf "cookie_number : $cookie_number\n";
$Pretty->("Cookie");
}
sub HTTP_set_cookie {
my ($set_cookie_trace_file, $set_cookie_parser_pf, $Pretty) = @_;
my $trace_file = Get_pcap($set_cookie_trace_file);
my $set_cookie_file = $trace_file . ".information/" . $trace_file . ".set_cookie";
unlink $set_cookie_file if -f $set_cookie_file;
my $set_cookie_frame_number = 0;
my $set_cookie;
my $set_cookie_number = 0;
my $set_cookie_pid = 0;
open my($SETCOOKIE_FILE), '>>', $set_cookie_file;
$set_cookie_pid = open my($SETCOOKIE), "tshark -r $set_cookie_trace_file -T fields -e frame.number -e http.set_cookie |";
# Sys::CpuAffinity::setAffinity($set_cookie_pid, [9]);
while(<$SETCOOKIE>){
if(/(\d+)\s+(.*)/){
$set_cookie_frame_number = $1;
$set_cookie = $2;
}
print $SETCOOKIE_FILE "Frame $set_cookie_frame_number: $set_cookie\n" if $set_cookie;
++$set_cookie_number if $set_cookie;
}
close($SETCOOKIE);
close($SETCOOKIE_FILE);
print $set_cookie_parser_pf "set_cookie_number : $set_cookie_number\n";
$Pretty->("Set-Cookie");
}
sub TCP_segment {
my ($tcp_segment_trace_file, $Pretty) = @_;
my $trace_file = Get_pcap($tcp_segment_trace_file);
my $tcp_segment_file = $trace_file . ".information/" . $trace_file . ".tcp_segment";
unlink $tcp_segment_file if -f $tcp_segment_file;
my $tcp_segment_frame_number = 0;
my $tcp_segment;
my $tcp_segment_pid = 0;
open my($TCPSEGMENT_FILE), '>>', $tcp_segment_file;
$tcp_segment_pid = open my($TCPSEGMENT), "tshark -r $tcp_segment_trace_file -T fields -e frame.number -e tcp.segment_data |";
# Sys::CpuAffinity::setAffinity($agent_pid, [6]);
while(<$TCPSEGMENT>){
# print $USERAGENT $_. "\n";
if(/(\d+)\s+(.*)/){
$tcp_segment_frame_number = $1;
$tcp_segment = $2;
}
# print "$tcp_segment_trace_file in Frame $tcp_segment_frame_number: $tcp_segment\n" and exit if $tcp_segment =~ /47/;
print $TCPSEGMENT_FILE "$tcp_segment_trace_file in Frame $tcp_segment_frame_number: $tcp_segment\n" and exit if $tcp_segment =~ /0d0a300d0a0d0a/;
# print $TCPSEGMENT_FILE "Frame $tcp_segment_frame_number: $tcp_segment\n" if $tcp_segment;
}
close($TCPSEGMENT);
close($TCPSEGMENT_FILE);
$Pretty->("TCP-Segment");
}
sub TCP_four_tuple {
my ($tuple_trace_file, $Pretty) = @_;
open my($TUPLE), "tshark -r $tuple_trace_file -T fields -e frame.number -e tcp.srcport -e tcp.dstport -e ip.src -e ip.dst |";
while(<$TUPLE>){
if(/(\d+)\s+(\d+)\s+(\d+)\s+(\d+\.\d+\.\d+\.\d+)\s+(\d+\.\d+\.\d+\.\d+)/){
# if ($2 == 3861 && $3 == 80){
if ($2 eq "3861" && $3 eq "80" && $4 eq "116.25.109.9" && $5 eq "110.75.200.3"){
print "You can see frame NO: $1\n";
}
}
}
close($TUPLE);
$Pretty->("TCP-Four-Tuple");
}
sub HTTP_status_code {
my ($status_trace_file, $status_parser_pf, $Pretty) = @_;
my @status_code;
my %status;
open my($STATUS), "tshark -r $status_trace_file -T fields -e http.response.code |";
while(<$STATUS>){
push @status_code, $1 if /(\d\d\d)/;
}
close($STATUS);
# print @status_code;
++$status{$_} for @status_code;
foreach my $code (keys %status){
print $status_parser_pf "status_code $code : $status{$code}\n";
}
$Pretty->("HTTP-Status-Code");
}
sub TCP_stream {
my ($stream_trace_file, $stream_parser_pf, $Pretty) = @_;
my $tcp_stream_number = 0;
my $last_tcp_stream = 0;
open my($STREAM), "tshark -r $stream_trace_file -T fields -e tcp.stream |";
while(<$STREAM>){
$last_tcp_stream = $1 if /(\d+)/;
$tcp_stream_number = $last_tcp_stream if ($last_tcp_stream > $tcp_stream_number);
}
close($STREAM);
++$tcp_stream_number;
print $stream_parser_pf "tcp_stream : $tcp_stream_number\n";
$Pretty->("TCP-Stream");
}
sub HTTP_content_length {
my ($length_trace_file, $length_parser_pf, $Pretty) = @_;
my $content_length_number = 0;
open my($LENGTH), "tshark -r $length_trace_file -T fields -e http.content_length |";
while(<$LENGTH>){
++$content_length_number if /\d+/;
}
close($LENGTH);
print $length_parser_pf "http_content_length : $content_length_number\n";
$Pretty->("HTTP-Content-Length");
}
sub HTTP_content_encoding {
my ($encoding_trace_file, $encoding_parser_pf, $Pretty) = @_;
my $content_encoding_number = 0;
open my($ENCODING), "tshark -r $encoding_trace_file -T fields -e http.content_encoding |";
while(<$ENCODING>){
++$content_encoding_number if /\w+/;
}
close($ENCODING);
print $encoding_parser_pf "http_content_encoding : $content_encoding_number\n";
$Pretty->("HTTP-Content-Encoding");
}
sub HTTP_transfer_encoding {
my ($transfer_trace_file, $transfer_parser_pf, $Pretty) = @_;
my $transfer_encoding_number = 0;
open my($TRANSFER), "tshark -r $transfer_trace_file -T fields -e http.transfer_encoding |";
while(<$TRANSFER>){
++$transfer_encoding_number if /\w+/;
}
close($TRANSFER);
print $transfer_parser_pf "http_transfer_encoding : $transfer_encoding_number\n";
$Pretty->("HTTP-Transfer-Encoding");
}
sub HTTP_traffic {
my ($http_traffic_trace_file, $http_traffic_parser_pf, $Pretty) = @_;
my $total_http_traffic = 0;
my $data_length = 0;
my $http_traffic = 0;
open my($HTTPTRAFFIC), "tshark -r $http_traffic_trace_file -T fields -e tcp.len -e frame.len |";
while(<$HTTPTRAFFIC>){
($data_length, $http_traffic) = split /\s+/;
$total_http_traffic += $http_traffic if ($data_length);
}
close($HTTPTRAFFIC);
print $http_traffic_parser_pf "http_traffic : $total_http_traffic\n";
$Pretty->("HTTP-Traffic");
}
sub TCP_IN_OUT {
# | Frames Bytes | | Frames Bytes | | Frames Bytes | Start |
#192.168.1.100:54988 <-> 143.248.142.36:http 9 6223 10 1863 19 8086 0.000000000 0.0000
# 13 14 15 16 17 18
my ($in_out_trace_file, $in_out_parser_pf, $Pretty) = @_;
my $in_pkts = 0;
my $out_pkts = 0;
my $in_bytes = 0;
my $out_bytes = 0;
open my($IN_OUT), "tshark -r $in_out_trace_file -q -z conv,tcp |";
while(<$IN_OUT>){
# 12 3 4 5 6 78 9 10 11 12 13 14
if (/((\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})):(.*)\s+<->\s+((\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})):(.*)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+\.\d+)\s+(\d+\.\d+)/){
# 15 16 17 18 19 20
$in_pkts += $15;
$out_pkts += $13;
$in_bytes += $16;
$out_bytes += $14;
}
}
close($IN_OUT);
print $in_out_parser_pf "tcp_in_pkts : $in_pkts\n";
$Pretty->("TCP_IN_PKTS");
print $in_out_parser_pf "tcp_out_pkts : $out_pkts\n";
$Pretty->("TCP_OUT_PKTS");
print $in_out_parser_pf "tcp_in_bytes : $in_bytes\n";
$Pretty->("TCP_IN_BYTES");
print $in_out_parser_pf "tcp_out_bytes : $out_bytes\n";
$Pretty->("TCP_OUT_BYTES");
}
sub Pretty_print {
my $field = shift;
print color 'bold blue';
print "Analyse finish $field \n";
print color 'reset';
}
sub Tshark {
if ( -f "/usr/bin/tshark" || -f "/usr/local/bin/tshark" || -f "/usr/sbin/tshark" ){
print "OK, tshark exist !\n";
}
else {
print "Tshark not found, please install it first !\n";
exit;
}
}
#############################Main Function###########################
Tshark();
chomp(my $file_list = $ARGV[0]);
print "Sorry, please run the script with a file list as ARGV !\n" and exit if !$file_list;
print "Sorry, trace file list $file_list not found !\n" and exit if !-f $file_list;
open my($PCAP), '<', $file_list;
while (my $trace_file = <$PCAP>){
chomp($trace_file);
my $pcap_file = Get_pcap($trace_file);
my $trace_file_path = $pcap_file . ".information";
rmdir $trace_file_path if -d $trace_file_path;
mkdir $trace_file_path;
my $parser_file = $trace_file_path . "/" . $pcap_file . ".parser";
unlink $parser_file if -f $parser_file;
open my($PARSER), '>>', $parser_file;
print color 'bold red';
print "\n===============>start process: $pcap_file, save information in $pcap_file" . ".information\n";
print color 'reset';
my $t1 = threads->create(\&Frame, $trace_file, $PARSER, \&Pretty_print);
my $t2 = threads->create(\&IP_fragment, $trace_file, $PARSER, \&Pretty_print);
my $t3 = threads->create(\&HTTP_user_agent, $trace_file, \&Pretty_print);
my $t4 = threads->create(\&HTTP_xforwarded_for, $trace_file, \&Pretty_print);
my $t5 = threads->create(\&HTTP_cookie, $trace_file, $PARSER, \&Pretty_print);
my $t6 = threads->create(\&HTTP_set_cookie, $trace_file, $PARSER, \&Pretty_print);
my $t7 = threads->create(\&L7, $trace_file, $PARSER, \&Pretty_print);
# my $t8 = threads->create(\&TCP_segment, $trace_file);
my $t9 = threads->create(\&TCP_out_of_order, $trace_file, $PARSER, \&Pretty_print);
my $t10 = threads->create(\&TCP_retransmission, $trace_file, $PARSER, \&Pretty_print);
my $t11 = threads->create(\&TCP_packet, $trace_file, $PARSER, \&Pretty_print);
my $t12 = threads->create(\&UDP_packet, $trace_file, $PARSER, \&Pretty_print);
my $t13 = threads->create(\&ICMP_packet, $trace_file, $PARSER, \&Pretty_print);
# my $t14 = threads->create(\&TCP_four_tuple, $trace_file);
my $t15 = threads->create(\&HTTP_status_code, $trace_file, $PARSER, \&Pretty_print);
my $t16 = threads->create(\&TCP_stream, $trace_file, $PARSER, \&Pretty_print);
my $t17 = threads->create(\&Four_tuple, $trace_file, $PARSER, \&Pretty_print);
my $t18 = threads->create(\&HTTP_content_length, $trace_file, $PARSER, \&Pretty_print);
my $t19 = threads->create(\&HTTP_content_encoding, $trace_file, $PARSER, \&Pretty_print);
my $t20 = threads->create(\&HTTP_transfer_encoding, $trace_file, $PARSER, \&Pretty_print);
my $t21 = threads->create(\&TCP_IN_OUT, $trace_file, $PARSER, \&Pretty_print);
my $t22 = threads->create(\&HTTP_traffic, $trace_file, $PARSER, \&Pretty_print);
my $t23 = threads->create(\&Ports_traffic, $trace_file, $PARSER, \&Pretty_print);
$t1->join();
$t2->join();
$t3->join();
$t4->join();
$t5->join();
$t6->join();
$t7->join();
# $t8->join();
$t9->join();
$t10->join();
$t11->join();
$t12->join();
$t13->join();
# $t14->join();
$t15->join();
$t16->join();
$t17->join();
$t18->join();
$t19->join();
$t20->join();
$t21->join();
$t22->join();
$t23->join();
print color 'bold green';
print "===============>process over: save information in $pcap_file" . ".information\n";
print color 'reset';
}
close($PARSER);
close($PCAP);
