Question

我有一个tcpdump文件，我设法拆分并解析它以获取我需要的信息：src ip + port和dst ip + port。

f = open('dump2.txt', 'r')
lines = f.read().splitlines(`)

for line in lines:
    line = line.split()
    if len(line) >0:
        srcIpList = line[2]
        srcIp = srcIpList.split('.')[:4]
        srcPortList = line[2]
        srcPort = srcPortList.split('.')[4:]
        dstIpList = line[4]
        dstIp = dstIpList.split('.')[:4]
        dstPortList = line[4]
        dstPort = dstPortList.split('.')[4:]

输出：

['142', '55', '1', '9'] ['80'] ['142', '55', '186', '239'] ['1220:']
['142', '55', '194', '76'] ['3956'] ['142', '55', '1', '9'] ['80:']
['142', '55', '1', '9'] ['80'] ['142', '55', '149', '106'] ['1591:']
['142', '55', '186', '239'] ['1220'] ['142', '55', '1', '9'] ['80:']
['142', '55', '1', '9'] ['80'] ['142', '55', '117', '173'] ['3784:']
['142', '55', '1', '9'] ['80'] ['142', '55', '117', '173'] ['3784:']
['142', '55', '149', '106'] ['1591'] ['142', '55', '1', '9'] ['80:']

现在我试图创建一个名为Hosts的字典，其中密钥是所有唯一的IP地址（src ip + dst ip），这些密钥用于记录重复ip地址的次数

我假设我必须通过if语句运行所有内容，它将IP地址添加到字典中并保留计数器添加相同地址的次数。

我的麻烦是我已经创建了列表但是没有关于如何将它们的内容转换为字典的线索。

修改该函数应该被称为Maker。使用Maker在我的字典中生成新的键/值对或修改现有条目。它假设为转储中的每一行执行此操作。

def Maker(src,dst):
      if src in list(Hosts()):
        #add one to the src counter in Hosts(src) array
      else Hosts[src] = [1,0]

      if dst in list(Hosts()):
        #add one to the dst counter in Hosts(dst) array
      else Hosts[dst] = [0,1]

用2个计数器键解析列表到字典

0 个答案: