Download proto

[TOC]1.实验环境说明开发语言：python集成开发环境：Pycharm开发平台：Windows102.程序总体框架基于Tkinter的Python GUI界面设计，使用scapy来对数据包进行抓取和解析。目前已实现的功能有：基本功能网卡选择抓取前数据包设置BPF过滤规则抓取数据包保存数据清除数据读取数据流量包基本信息显示协议分析hexdump内容流量分析功能流量协议统计（分层）获取http/https请求（该功能存在问题）流入/出流量IP归属地查询和统计流量时间统计3.程序关键算法和流程图主要的算法流程图：抓取并处理数据包的线程使用sniff()对数据包进行抓取，并将数据包传递给回调函数process_packet()进行处理def capture_packet(): ''' 抓取数据包并保存 :return: ''' # 设置过滤条件 filters = filter_entry.get() print("抓包条件：" + filters) nic = select_nic_combo.get().strip() print("网卡：", nic) stop_sending.clear() tmp = time.strftime('%Y_%m_%d_%H_%M_%S', time.localtime(time.time())) filename = r".\log\packet_log_%s.txt" % (tmp) if (nic != 'ALL'): # 抓取数据包并将抓到的包存在列表中 sniff(iface=nic, prn=(lambda x: process_packet(x,filename)), filter=filters, stop_filter=(lambda x: stop_sending.is_set())) else: # 抓取数据包并将抓到的包存在列表中 sniff(prn=(lambda x: process_packet(x, filename)), filter=filters, stop_filter=(lambda x: stop_sending.is_set())) def process_packet(packet,filename): ''' 对抓到的数据包进行处理 :param packet: :return: ''' lock.acquire() global packet_list # 将抓到的包存在列表中 packet_list.append(packet) # 抓包的时间 time_array = time.localtime(packet.time) packet_time = time.strftime("%Y-%m-%d %H:%M:%S", time_array) ether_info_tuple = process_Ether(packet) proto = ether_info_tuple[0] src = ether_info_tuple[1] dst = ether_info_tuple[2] ip_info_tuple = process_IP(packet, ether_info_tuple[0]) if (ip_info_tuple != None): proto = ip_info_tuple[0] src = ip_info_tuple[1] dst = ip_info_tuple[2] proto = process_Transfer(packet, proto) flag = process_http(packet) if (flag == True): print("index", len(packet_list)) length = len(packet) # 长度 info = packet.summary() # 信息 global packet_id # 数据包的编号 packet_list_tree.insert("", 'end', packet_id, text=packet_id, values=(packet_id, packet_time, src, dst, proto, length, info)) packet_list_tree.update_idletasks() # 更新列表，不需要修改 packet_id = packet_id + 1 # 将数据包的信息记录到日志中 with open(filename, "a+") as f: if (packet_id-1== 1): header = 'packet_id' + '\t' + 'packet_time' + '\t' + 'src' + '\t' + 'dst' + '\t' + 'proto' + '\t' + 'length' + '\t' + 'info' + '\n' f.write(header) record = str(packet_id-1) + '\t' + str(packet_time) + '\t' + str(src) + '\t' + str(dst) + '\t' + str(proto) + '\t' + str(length)+ '\t' + str(info) + '\n' f.write(record) lock.release()对各层的数据包进行解析对Ether层进行解析def process_Ether(packet): src = packet[Ether].src dst = packet[Ether].dst type = packet[Ether].type types = {0x0800: 'IPv4', 0x0806: 'ARP', 0x86dd: 'IPv6', 0x88cc: 'LLDP', 0x891D: 'TTE'} if type in types: proto = types[type] else: proto = 'LOOP' # 协议 if proto in ether_info: ether_info[proto] += 1 else: ether_info[proto] = 1 return (proto, src, dst)对IP层进行解析def process_IP(packet, proto): # IP if proto == 'IPv4': # 建立协议查询字典 protos = {1: 'ICMP', 2: 'IGMP', 4: 'IP', 6: 'TCP', 8: 'EGP', 9: 'IGP', 17: 'UDP', 41: 'IPv6', 50: 'ESP', 89: 'OSPF'} src = packet[IP].src dst = packet[IP].dst proto = packet[IP].proto if proto in protos: proto = protos[proto] if proto in ip_info: ip_info[proto] += 1 else: ip_info[proto] = 1 return (proto, src, dst) elif proto == 'IPv6': protos = { 4: "IP", 6: "TCP", 17: "UDP", 41: "IPv6", 47: "GRE", 58: "ICMPv6", 112: "VRRP", 132: "SCTP", } src = packet[IPv6].src dst = packet[IPv6].dst proto = packet[IPv6].nh if proto in protos: proto = protos[proto] if proto in ip_info: ip_info[proto] += 1 else: ip_info[proto] = 1 return (proto, src, dst) else: return None对传输层进行解析def process_Transfer(packet, proto): # tcp if TCP in packet: protos_tcp = {80: 'Http', 443: 'Https', 23: 'Telnet', 21: 'Ftp', 20: 'ftp_data', 22: 'SSH', 25: 'SMTP'} sport = packet[TCP].sport dport = packet[TCP].dport if sport in protos_tcp: proto = protos_tcp[sport] if proto in tcp_info: tcp_info[proto] += 1 else: tcp_info[proto] = 1 elif dport in protos_tcp: proto = protos_tcp[dport]

Someone who helped in development with Proto Stealth, I can confirm it's totally legitimate. My current KV has been online for 50 days and counting. Proto rocks! #6 Vouch,As someone who helped in development with Proto Stealth, I can confirm it's totally legitimate.My current KV has been online for 50 days and counting.Proto rocks! We're glad that proto has provided you with the most satisfying experience.Plus, you helped make proto more secure and the way it is today. Without all of you folks testing, and ensuring our other users of Proto are getting the same specialty and satisfaction.We could not ever thank you enough for your continued service. So, thank you from the PL/Proto team! #7 I must say, Proto is awesome/ I've used the service numerous times with no issues. The best part is that it's free and doesn't backdoor your console like some other stealth services out there do.Welcome to Se7ensins Proto Stealth! P.S - ILY nicholasbroo #8 I must say, Proto is awesome/ I've used the service numerous times with no issues. The best part is that it's free and doesn't backdoor your console like some other stealth services out there do.Welcome to Se7ensins Proto Stealth! P.S - ILY nicholasbrooCan you please elaborate on how other servers backdoor your console? As for this service, I have not used it yet but everything looks great! Thank you nicholasbroo for offering a free stealth server for everyone. Also congrats on already having 1000+ users that is amazing! #9 Can

To completely disconnect one to get it to work.Let me know what other settings or logs you might need to help diag.I have assigned Static IPs to both PS4s (192.168.1.30 and 192.168.1.31) @vMACMake sure you enable Pure NAT, and check "Enable automatic outbound NAT for Reflection" under System / Advanced / Firewall & NAT @Marc05After changing those settings this is what I get:[2.5.0-DEVELOPMENT][[email protected]]/root: pfSsh.php playback pfanchordrillipsec rules/nat contents:miniupnpd rules/nat contents:nat quick on em0 inet proto udp from 192.168.1.31 port = 9308 to any keep state label "192.168.1.31:9308 to 9308 (UDP)" rtable 0 -> 24.255.xxx.xxx port 9308nat quick on em0 inet proto udp from 192.168.1.31 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 24.255.xxx.xxx port 3074nat quick on em0 inet proto udp from 192.168.1.30 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 24.255.xxx.xxx port 3108nat quick on em0 inet proto udp from 192.168.1.30 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 24.255.xxx.xxx port 3167nat quick on em0 inet proto udp from 192.168.1.30 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 24.255.xxx.xxx port 3116nat quick on em0 inet proto udp from 192.168.1.31 port = 9305 to any keep state label "192.168.1.31:9305 to 9305 (UDP)" rtable 0 -> 24.255.xxx.xxx port 9305nat quick on em0 inet proto udp from 192.168.1.31 port = 9306 to any keep state label "192.168.1.31:9306 to 9306 (UDP)" rtable 0 -> 24.255.xxx.xxx port 9306nat quick on em0 inet proto udp from 192.168.1.31 port = 3659 to any keep state label "EA Tunnel" rtable 0 -> 24.255.xxx.xx port 3659nat quick on em0 inet proto udp from 192.168.1.30 port = 3074 to any keep state label "DemonwarePortMapping" rtable 0 -> 24.255.xxx.xxx port 3172nat quick on em0 inet proto udp from 192.168.1.30 port = 3074 to any