1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /><title>natkit</title>
<meta name="generator" content="amaya 8.5, see http://www.w3.org/Amaya/" />
<link rel="stylesheet" type="text/css" href="plt-doc.css" /></head><body>
<h2>natkit Module</h2>
<p>This Module provides methods that are useful when analysing network trace files.</p>
<h3>Module Functions</h3>
<h4>get_short() and get_long()</h4>
<p>Provide methods for getting unsigned numbers ('Network
Integers') from a byte array. <br />Assumes that the bytes are in
network order in that array, for example because it contains bytes
from a packet payload.</p>
<table class="indent1">
<tbody>
<tr>
<td class="name methodwidth"><strong>ba_get_short()</strong></td>
<td class="name descriptionwidth"><em>natkit.ba_get_short(ByteArray, Integer) -> anInteger</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Gets an unsigned 16-bit number from <span style="font-style: italic;">ByteArray[Integer]. </span> <br />For example, <span style="font-style: italic;">natkit.get_short(IP.data, 20)</span> returns the number contained in <span style="font-style: italic;">IP.data[20]</span> through <span style="font-style: italic;">IP.data[21]</span><br /></td>
</tr>
<tr>
<td class="name methodwidth"><strong>ba_get_long()</strong></td>
<td class="name descriptionwidth"><em>natkit.ba_get_long(ByteArray, Integer) -> anInteger</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Gets an unsigned 32-bit number from <span style="font-style: italic;">ByteArray[Integer]. </span><br />For example, <span style="font-style: italic;">natkit.get_short(IP.data, 33)</span> returns the number contained in <span style="font-style: italic;">IP.data[33]</span> through <span style="font-style: italic;">IP.data[36]</span></td>
</tr>
</tbody></table>
<br />
<h4>TCP sequence number arithmetic<br />
</h4>
<table class="indent1">
<tbody>
<tr><td class="name methodwidth"><strong>u32_add()</strong></td>
<td class="name descriptionwidth"><em>natkit.seq_add(seq_a, seq_b) -> anInteger</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Returns <span style="font-style: italic;">seq_a + seq_b</span><br /></td>
</tr>
<tr>
<td class="name methodwidth"><strong>u32_sub()</strong></td>
<td class="name descriptionwidth"><em>natkit.u32_sub(seq_a, seq_b) -> anInteger</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Returns <span style="font-style: italic;">seq_a - seq_b</span></td>
</tr>
<tr>
<td class="name methodwidth"><strong>seq_lt()</strong></td>
<td class="name descriptionwidth"><em><em>natkit.seq_lt(seq_a, seq_b)
-> True or False </em></em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Returns <span style="font-style: italic;">True</span> if <span style="font-style: italic;"> seq_a < U32_b</span><span style="font-style: italic;" /></td>
</tr>
<tr>
<td class="name"><strong>seq_ge()</strong></td>
<td class="name"><em><em>natkit.seq_ge(ne(seq_a, seq_b)
-> True or False </em></em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Returns <span style="font-style: italic;">True</span> if <span style="font-style: italic;">SEQ_a >= seq_b</span><span style="font-style: italic;"><span style="font-weight: bold;" /></span></td>
</tr>
<tr>
<td class="name"><strong>seq_gt()</strong></td>
<td class="name"><em><em>natkit.seq_gt(seq_a, seq_b)
-> True or False </em></em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Returns <span style="font-style: italic;">True</span> if <span style="font-style: italic;">seq_a > seq_b,</span><span style="font-style: italic;"><span style="font-weight: bold;" /></span></td>
</tr>
</tbody></table>
<br />
<h3>Class FlowHome<br />
</h3>
<p>Allows you to specify a tuple of IPprefixes for addresses that lie within a <span style="font-style: italic;">home</span> network. A FlowHome object can then be used to create IPflows (see below). IPflows created in this way
have the same flow-key string for packets in each direction, i.e. the
direction matching is done by natkit in C, so you don't have to do it
yourself in Python.<br />
<span style="font-style: italic;" /></p>
<table class="indent1">
<tbody>
<tr>
<td class="heading" colspan="2">Class Functions <br />
</td>
</tr>
<tr>
<td class="name methodwidth"><strong>FlowHome</strong>()<br />
</td>
<td class="name descriptionwidth"><em>natkit.FlowHome(IPP1, IPP2, ..., IPPn) -> aFlowHome<br />
</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Makes an object that specifies a home network for IP flows<span style="font-style: italic;">.</span> <br />
IPP1 ..., IPPn is a tuple of IPprefixes that are owned by the home
network. The IPprefixes can be any mix of IPv4 and IP6 prefixes.<br />
<span style="font-family: monospace;" /></td>
</tr>
<tr>
<td class="name methodwidth"><strong>flow()</strong></td>
<td class="name descriptionwidth"><em>flow_home.flow(plt_obj)-> anIPflow</em></td>
</tr>
<tr>
<td style="vertical-align: top;"><br />
</td>
<td style="vertical-align: top;">Uses
a FlowHome object to create
an IPflow, with its source and destination fields ordered such that the
IPflow's destination address beongs to the home network, and its source
address does not. This function's argument can be any python-libtrace
object that was
derived from a packet; it will usually be either a Packet or an
Internet object.<br />
</td>
</tr>
</tbody></table>
<br />
<h3>Class IPflow</h3>
<p>Provides methods for creating and using network <span style="font-style: italic;">flow keys</span>, i.e. <span style="font-style: italic;">Strings</span> that describe a flow, and which can be used as keys for a Python Dictionary.<br />For a simple flow, the first-seen packet is assumed to be in <span style="font-style: italic;">forward</span> order.<span style="font-style: italic;"> </span><br />
For a flow created using a FlowHome, forward order is<span style="font-style: italic;"> into the home network.</span><br />
Note: a<span style="font-style: italic;">n IPflow</span> is a bi-directional <span style="font-style: italic;">flow</span>, it's key is the 6-tuple <span style="font-style: italic;">(IP version, protocol, source port, destination port, source IP address, destination IP address). </span> <br />
</p>
<table class="indent1"><tbody>
<tr><td class="heading" colspan="2">Class Function</td>
</tr>
<tr>
<td class="name methodwidth"><strong>flow()</strong><br />
</td>
<td class="name descriptionwidth"><em>natkit.IPflow(plt_obj) -> anIPflow<br />
</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Makes an IPflow (as described above).<br />
This function's argument can be any python-libtrace obje<strong>ct that
was derived from a packet; it will usually be either a Packet or an
Internet object.<br />
<span style="font-family: monospace;" /></strong></td>
</tr>
<tr><td class="heading" colspan="2">Instance Attributes</td>
</tr>
<tr>
<td class="name methodwidth"><strong>fwd_key</strong><br />
</td>
<td class="name descriptionwidth"><em>ipf.fwd_key -> aString</em><br />
</td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Returns a key string, with source and destination in flow order for an IPflow.<br />
</td>
</tr>
<tr>
</tr><tr>
<td class="name methodwidth"><strong>rev_key</strong><br />
</td>
<td class="name descriptionwidth"><em>ipf.rev_key -> aString<br />
</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Returns a key string, with source and destination in the order opposite to that returned by ipf.fwd_key.<br />
</td>
</tr>
<tr>
</tr><tr>
<td class="name methodwidth"><strong>version<br />
</strong></td>
<td class="name descriptionwidth"><em>ipf.version -> 4 or 6<br />
</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Returns the IP version number for the packet.<br />
</td>
</tr>
<tr>
</tr><tr>
<td class="name methodwidth"><strong>proto</strong><br />
</td>
<td class="name descriptionwidth"><em>ipf.proto -> anInteger</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">IP protocol number from Internet header.<br />
</td>
</tr>
<tr>
</tr><tr>
<td class="name methodwidth"><strong><span style="font-weight: bold;">src_port</span><br />
</strong></td>
<td class="name descriptionwidth"><em>ipf.src_port -> anInteger<br />
</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Source port number from TCP or UDP header.<br />
</td>
</tr>
<tr>
</tr><tr>
<td class="name methodwidth"><strong>dst_port</strong></td>
<td class="name descriptionwidth"><em>ipf.dst_port-> anInteger<br />
</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Destination port number from TCP or UDP header.<br />
</td>
</tr>
<tr>
</tr><tr>
<td class="name methodwidth"><strong>src_prefix</strong></td>
<td class="name descriptionwidth"><em>ipf.src_prefix-> anIPprefix<br />
</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Source IP address from Internet header.<br />
</td>
</tr>
<tr>
</tr><tr>
<td class="name methodwidth"><strong>dst_prefix</strong></td>
<td class="name descriptionwidth"><em>ipf.dst_prefix -> anIPprefix<br />
</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Destination IP address from Internet header.<br /><br />
</td>
</tr>
<tr>
</tr><tr>
<td class="name methodwidth"><strong>home_key</strong><br />
</td>
<td class="name descriptionwidth"><em>ipf.home_key -> aString<br />
</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Returns a key string, with source and
destination in flow order. Returns None for an IPflow for an IPflow
created using a FlowHome.
</td>
</tr>
<tr>
</tr><tr>
<td class="name methodwidth"><strong>src_in_home</strong></td>
<td class="name descriptionwidth"><em>ipf.src_in_home-> True or False<br />
</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Returns True if the packet's source IP address is in the home network.<br />
</td>
</tr>
<tr>
</tr><tr>
<td class="name methodwidth"><strong>dst_in_home</strong></td>
<td class="name descriptionwidth"><em>ipf.dst_in_home-> True or False<br />
</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Returns True if the packet's destination IP address is in the home network.
</td>
</tr>
<tr>
</tr><tr>
<td class="name methodwidth"><strong>is_inward</strong><br />
</td>
<td class="name descriptionwidth"><em>ipf.is_inward -> True or False<br />
</em></td>
</tr>
<tr>
<td><br />
</td>
<td class="description">Returns True if the packet's destination IP
address is in the home network, i.e. only one of it's source and
destination addresses is in the home network.
</td>
</tr>
</tbody></table>
<br />
<p /><p>Nevil Brownlee<br />
Mon, 13 Apr 15 (NZST)</p>
</body></html>
|
