How to make a "time-Slice" in packages in a network dump with Python?

Question

I’m trying to "grab" source Ips and target Ips inside a network dump (PCAP) file. The idea is to save all source Ips and all target IPS by scanning the file every 10 minutes ("time-Slice"), for example.

The code below opens the dump ("capture.pcap") and prints the times of the packages. How to "separate" the packages every 10 min? I don’t understand what times these are... Would they be Milesegundo? What unit of time is used?

from scapy.all import *

pkts = rdpcap("captura.pcap")

for p in pkts:
    print p.time

The exit is:

1488498263.14
1488498263.15
1488498263.15
1488498263.15
1488498263.31
1488498263.31
1488498263.31
1488498263.6
1488498263.78
1488498264.49
1488498264.49
1488498264.49
1488498264.49
1488498264.5
1488498264.5
1488498264.5
1488498264.5
1488498265.07
1488498265.07

Answer 1

These values are in timestamp:

In python2.7 you can import the datetime to make conversions of timestamp

>>> import datetime
>>> datetime.datetime.fromtimestamp(1488498263.14)
datetime.datetime(2017, 3, 2, 20, 44, 23, 140000)
>>>

As an example I used your first timestamp=1488498263.14 note the function return notation which is equivalent to year/month/day hour/minutes/seconds = 2/3/2017 20:44:23, you just take the return data and mount it the way you want it!

One way to get the values you need is not to convert the timestamp, if you want to take the values every 10 minutes then add the first timestamp + 10 min in timestamp and go saving the values that are less or equal to the value of timestamp + 10, OK you took 10 min of data, now for the next timestamp you make the same logic sum the next timestamp + 10 again and go walking and keeping all values that is less or equal and do this until the end, the logic is this:

First value + 10 min timestamp:

1488498263.14+ 10 * 60 = 1488498863.14

Walk on your go keeping all values/lines that are less than or equal to 1488498863.14, when you find a higher value add that value + 10 * 60 again and store all values within that period, do this until the end, there is no easy way use logic...

pkts = [1488498263.14, 1488498263.15, 1488498263.15, 1488498263.15, 1488498263.31, 1488498263.31, 1488498263.31, 1488498263.6, 1488498263.78, 1488498264.49, 1488498264.49, 1488498264.49, 1488498264.49, 1488498264.5, 1488498264.5, 1488498264.5, 1488498264.5, 1488498265.07, 1488498265.07]


somaMin = pkts[0] + 1

valores=[]
for p in pkts:

    if p<=somaMin:
        #armazenando os valores que estiverem dentro do intervalo de tempo
        valores.append(p)

    else:

        #processe aqui tudo que tem no vetor valores, eles vão conter os dados no intervalo desejado

        #apagando tudo que tem dentro do vetor para receber os próximos dados
        valores=[]
        #armazenando o próximo valor
        valores.append(p)
        #somando o valor novamente
        somaMin=p+ 1

#processe aqui tudo que restou no vetor valores, eles vão conter os dados que sobraram

I don’t have all the data from your Sniffer, but using the data you showed, it’s about 2 seconds, so I did:

somaMin = pkts[0] + 1

But in your case change the somaMin to be + 10 * 60

somaMin = pkts[0] + 10 * 60

Don’t forget inside Isis either:

somaMin=p+ 10 * 60

I can’t be any clearer than that lol