How can I create a Python program to analyze a packet capture file and identify the geolocations of IP addresses using GeoIP2?

Varister · 02-12-2022, 04:15 PM

The following is what I have so far. I am trying to analyze geotest.pcap file and list each packet's city, country, source, and destination IP using GeoIP2.

Code:

import dpkt
import socket
import geoip2
import optparse

gi = geoip2.database("/home/user/GeoLite2-City.mmdb")

def retGeoStr(ip):
   try:
      rec = gi.record_by_name(ip)
      city = rec['city']
      country = rec['country_code3']
      if city != '':
         geoLoc = city + ', ' + country
      else:
         geoLoc = country
      return geoLoc
   except Exception as e:
      return 'Unregistered'

def printPcap(pcap):
   for (ts, buf) in pcap:
      try:
         eth = dpkt.ethernet.Ethernet(buf)
         ip = eth.data
         src = socket.inet_ntoa(ip.src)
         dst = socket.inet_ntoa(ip.dst)
         print ("[+] Src: " + src + " - - > Dst: " + dst)
         print ("[+] Src: " + retGeoStr(src) + " - - > Dst: " + retGeoStr(dst))
      except:
         pass

def main():
   parser = optparse.OptionParser("usage%prog "+\
      "-p <pcap filename> ")
   parser.add_option('-p', dest='pathName', type='string',\
      help='specify pcap filename')
   (options, args) = parser.parse_args()
   pcapFile = options.pcapFile
   if options.pcapFile == None:
         print (parser.usage)
         exit(0)
   f = open('geotest.pcap')
   pcap = dpkt.pcap.Reader(f)
   printPcap(pcap)
   
if __name__ == "__main__":
  main()

boughtonp · 02-12-2022, 04:19 PM

You must use "[code]..[/code]" to preserve formatting - this is vital for a language like Python.

(There is also a "Preview Post" button - it should be standard practise to use this when creating a new thread.)

As for the issue itself, what happens when you run it - i.e. where is the code deviating from what you expect to occur?

dugan · 02-13-2022, 11:04 AM

Take out the try/except statements. All they're doing is preventing you from seeing and fixing actual issues.

If you want to use try/except, then the try block should be one statement long, and it should only catch the specific exception subclass thrown by that statement.

sundialsvcs · 02-14-2022, 10:13 AM

Have you first done a very thorough search of the Python package repositories, and of places such as GitHub and SourceForge?

No matter what it is that you're planning to do these days, it is a certainty that someone else has already done it better than you did. And also, that various people have written and debugged "packages" to help you do a lot of the heavy lifting without debugging all of it yourself.

No matter what it is you're doing, plan not to "start from scratch" on anything.

"Actum Ne Agas: Do Not Do A Thing Already Done."