idstools.scripts.eve2pcap module

Convert packets in EVE logs to pcap.

eve2pcap will convert the packets or the payloads found in an eve log file to a pcap file.

Note that payload conversion requires Scapy, and will not recreate the original packets as the headers need to be built on the fly from the available information in the eve log.

class idstools.scripts.eve2pcap.Pcap(pcap_t)

Bases: object

dump_fopen(fileno)

Not quite a direct wrapper around pcap_dump_fopen - instead of a file pointer, take a file descriptor.

dump_open(filename)

get_err()

classmethod open_dead(linktype, snaplen)

class idstools.scripts.eve2pcap.PcapDumper(pcap_dumper_t)

Bases: object

Minimal wrapper around pcap_dumper_t.

close()

dump(pkthdr, packet)

idstools.scripts.eve2pcap.eve2pcap(event)

idstools.scripts.eve2pcap.main()

idstools.scripts.eve2pcap.parse_timestamp(timestamp)

idstools.scripts.eve2pcap.payload2packet(event)

class idstools.scripts.eve2pcap.pcap_pkthdr

Bases: _ctypes.Structure

Internal class representing struct pcap_pkthdr.

caplen

Structure/Union member

pktlen

Structure/Union member

ts_sec

Structure/Union member

ts_usec

Structure/Union member