import pandas as pd
from ipaddress import IPv4Address, AddressValueError
wireshark_columns_of_interest = {
"layers.ip.ip.src_host": "src_ip",
"layers.eth.eth.src": "src_mac",
"layers.eth.eth.src_tree.eth.src.oui_resolved": "src_mac_company",
"layers.ip.ip.dst_host": "dest_ip",
"layers.frame.frame.protocols": "protocol",
"layers.frame.frame.coloring_rule.name": "category",
}
[docs]
def wireshark_private_ips(file):
"""Return private IP addresses from a Wireshark JSON file
:param file: Valid path to a Wireshark JSON file
:type file: str
:return: IPv4Address objects within the range that falls under the category of Private networks
:rtype: list
"""
df = wireshark_extract(file).reset_index()
source_ips = set(df["src_ip"].tolist())
destination_ips = set(df["dest_ip"].tolist())
all_ips = source_ips.union(destination_ips)
all_private_ips = []
for ip in all_ips:
try:
ip_object = IPv4Address(ip)
if ip_object.is_private:
all_private_ips.append(ip_object)
except AddressValueError:
pass
return sorted(all_private_ips)
[docs]
def wireshark_mac_addresses(file):
"""Return MAC Address/Manufacturer information from a Wireshark JSON file
:param file: Valid path to a Wireshark JSON file
:type file: str
:return: docs_source mac, docs_source mac manufacturing company
:rtype: Pandas.DataFrame
"""
source_df = wireshark_extract(file).reset_index()
groupby_df = (
source_df.groupby("src_mac")["src_mac_company"].value_counts().reset_index()
)
mac_df = groupby_df[["src_mac", "src_mac_company"]]
return mac_df