README
1# Dshell
2An extensible network forensic analysis framework. Enables rapid development of plugins to support the dissection of network packet captures.
3
4Key features:
5* Deep packet analysis using specialized plugins
6* Robust stream reassembly
7* IPv4 and IPv6 support
8* Custom output handlers
9* Chainable plugins
10
11## Requirements
12* Linux (developed on Red Hat Enterprise Linux 6.7)
13* Python 3 (developed with Python 3.6.2)
14* [pypacker](https://gitlab.com/mike01/pypacker)
15* [pcapy](https://github.com/helpsystems/pcapy)
16* [pyOpenSSL](https://github.com/pyca/pyopenssl)
17* [geoip2](https://github.com/maxmind/GeoIP2-python)
18 * [MaxMind GeoIP2 datasets](https://dev.maxmind.com/geoip/geoip2/geolite2/)
19
20## Optional
21* [oui.txt](http://standards-oui.ieee.org/oui.txt)
22 * used by some plugins that handle MAC addresses
23 * place in <dshell>/data/
24* [elasticsearch](https://www.elastic.co/guide/en/elasticsearch/client/python-api/current/index.html)
25 * used in the elasticout output module
26 * only necessary if planning to use elasticsearch to store output
27* [pyJA3](https://github.com/salesforce/ja3/tree/master/python)
28 * used in the tls plugin
29
30## Major Changes Since Previous Release
31* This is a major framework update to Dshell. Plugins written for the previous version are not compatible with this version, and vice versa.
32* Uses Python 3
33 * Rewritten in Python 3 from the ground up. Python 2 language deprecated on [1 JAN 2020](https://www.python.org/doc/sunset-python-2/)
34 * By extension, dpkt and pypcap have been replaced with Python3-friendly pypacker and pcapy (respectively).
35* Is a Python package
36 * Converted into a single package, removing the need for the shell to set several environment variables.
37 * Allows easier use of Dshell plugins in other Python scripts
38* Changed "decoders" to "plugins"
39 * Primarily a word-swap, to clarify that "decoders" can do more than simply decode traffic, and to put Dshell more in line with the terminology of other frameworks.
40* Significant reduction in camelCase functions, replaced with more Pythonic snake\_case functions.
41 * Notable examples include blobHandler->blob\_handler, rawHandler->raw\_handler, connectionInitHandler->connection\_init\_handler, etc.
42* All plugins are now chainable
43 * To accommodate this, handler functions in plugins must now use return statements indicating whether a packet, connection, or similar will continue to the next plugin. The type of object(s) to return depends on the type of handler, but will generally match the types of the handler's input. Dshell will display a warning if it's not the right type.
44* Plugins can now use all output modules<sup>\*</sup> available to the command line switch, -O
45 * That does not mean every output module will be _useful_ to every plugin (e.g. using netflow output for a plugin that looks at individual packets), but they are available.
46 * alert(), write(), and dump() are now the same function: write()
47 * Output modules can be listed with a new flag in decode.py, --list-output or --lo
48 * Arguments for output modules are now passed with the --oargs command-line argument
49 * \* pcapout is (currently) the exception to this rule. A method has yet to arise that allows it to work with connection-based plugins
50* No more dObj declaration
51 * decode.py just looks for the class named DshellPlugin and creates an instance of that
52* Improved error handling
53 * Dshell handles more of the most common exceptions during everyday use
54* Enables development of external plugin packs, allowing the sharing and installation of new, externally-developed plugins without overlapping the core Dshell libraries.
55
56## Installation
57
581. Install Dshell with pip
59 * `sudo python3 -m pip install Dshell/` OR `sudo python3 -m pip install <Dshell-tarball>`
602. Configure geoip2 by moving the MaxMind data files (GeoLite2-ASN.mmdb, GeoLite2-City.mmdb, GeoLite2-Country.mmdb) to <install-location>/data/GeoIP/
613. Run `dshell`. This should drop you into a `Dshell> ` prompt.
62
63## Basic Usage
64
65* `decode -l`
66 * This will list all available plugins, alongside basic information about them
67* `decode -h`
68 * Show generic command-line flags available to most plugins
69* `decode -p <plugin>`
70 * Display information about a plugin, including available command line flags
71* `decode -p <plugin> <pcap>`
72 * Run the selected plugin on a pcap file
73* `decode -p <plugin1>+<plugin2> <pcap>`
74 * Chain two (or more) plugins together and run them on a pcap file
75* `decode -p <plugin> -i <interface>`
76 * Run the selected plugin live on an interface (may require superuser privileges)
77
78## Usage Examples
79Showing DNS lookups in [sample traffic](http://wiki.wireshark.org/SampleCaptures#General_.2F_Unsorted)
80
81```
82Dshell> decode -p dns ~/pcap/dns.cap |sort
83[DNS] 2005-03-30 03:47:46 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 4146, TXT? google.com., TXT: b'\x0fv=spf1 ptr ?all' **
84[DNS] 2005-03-30 03:47:50 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 63343, MX? google.com., MX: b'\x00(\x05smtp4\xc0\x0c', MX: b'\x00\n\x05smtp5\xc0\x0c', MX: b'\x00\n\x05smtp6\xc0\x0c', MX: b'\x00\n\x05smtp1\xc0\x0c', MX: b'\x00\n\x05smtp2\xc0\x0c', MX: b'\x00(\x05smtp3\xc0\x0c' **
85[DNS] 2005-03-30 03:47:59 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 18849, LOC? google.com. **
86[DNS] 2005-03-30 03:48:07 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 39867, PTR? 104.9.192.66.in-addr.arpa., PTR: 66-192-9-104.gen.twtelecom.net. **
87[DNS] 2005-03-30 03:49:18 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 30144, A? www.netbsd.org., A: 204.152.190.12 (ttl 82159s) **
88[DNS] 2005-03-30 03:49:35 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 61652, AAAA? www.netbsd.org., AAAA: 2001:4f8:4:7:2e0:81ff:fe52:9a6b (ttl 86400s) **
89[DNS] 2005-03-30 03:50:35 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 32569, AAAA? www.netbsd.org., AAAA: 2001:4f8:4:7:2e0:81ff:fe52:9a6b (ttl 86340s) **
90[DNS] 2005-03-30 03:50:44 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 36275, AAAA? www.google.com., CNAME: 'www.l.google.com.' **
91[DNS] 2005-03-30 03:50:54 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 56482, AAAA? www.l.google.com. **
92[DNS] 2005-03-30 03:51:35 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 48159, AAAA? www.example.com. **
93[DNS] 2005-03-30 03:51:46 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 9837, AAAA? www.example.notginh., NXDOMAIN **
94[DNS] 2005-03-30 03:52:17 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 65251, AAAA: 2001:4f8:0:2::d (ttl 600s), A: 204.152.184.88 (ttl 600s) **
95[DNS] 2005-03-30 03:52:17 192.168.170.8:32796 -- 192.168.170.20:53 ** ID: 23123, PTR? 1.0.0.127.in-addr.arpa., PTR: localhost. **
96[DNS] 2005-03-30 03:52:17 192.168.170.8:32797 -- 192.168.170.20:53 ** ID: 8330, NS: b'\x06ns-ext\x04nrt1\xc0\x0c', NS: b'\x06ns-ext\x04sth1\xc0\x0c', NS: b'\x06ns-ext\xc0\x0c', NS: b'\x06ns-ext\x04lga1\xc0\x0c' **
97[DNS] 2005-03-30 03:52:17 192.168.170.56:1707 -- 217.13.4.24:53 ** ID: 12910, SRV? _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.utelsystems.local., NXDOMAIN **
98[DNS] 2005-03-30 03:52:17 192.168.170.56:1708 -- 217.13.4.24:53 ** ID: 61793, SRV? _ldap._tcp.dc._msdcs.utelsystems.local., NXDOMAIN **
99[DNS] 2005-03-30 03:52:17 192.168.170.56:1709 -- 217.13.4.24:53 ** ID: 33633, SRV? _ldap._tcp.05b5292b-34b8-4fb7-85a3-8beef5fd2069.domains._msdcs.utelsystems.local., NXDOMAIN **
100[DNS] 2005-03-30 03:52:17 192.168.170.56:1710 -- 217.13.4.24:53 ** ID: 53344, A? GRIMM.utelsystems.local., NXDOMAIN **
101[DNS] 2005-03-30 03:52:25 192.168.170.56:1711 -- 217.13.4.24:53 ** ID: 30307, A? GRIMM.utelsystems.local., NXDOMAIN **
102```
103
104Following and reassembling a stream in [sample traffic](http://wiki.wireshark.org/SampleCaptures#General_.2F_Unsorted)
105
106```
107Dshell> decode -p followstream ~/pcap/v6-http.cap
108Connection 1 (TCP)
109Start: 2007-08-05 15:16:44.189851
110End: 2007-08-05 15:16:44.219460
1112001:6f8:102d:0:2d0:9ff:fee3:e8de: 59201 -> 2001:6f8:900:7c0::2: 80 (300 bytes)
1122001:6f8:900:7c0::2: 80 -> 2001:6f8:102d:0:2d0:9ff:fee3:e8de: 59201 (2379 bytes)
113
114GET / HTTP/1.0
115Host: cl-1985.ham-01.de.sixxs.net
116Accept: text/html, text/plain, text/css, text/sgml, */*;q=0.01
117Accept-Encoding: gzip, bzip2
118Accept-Language: en
119User-Agent: Lynx/2.8.6rel.2 libwww-FM/2.14 SSL-MM/1.4.1 OpenSSL/0.9.8b
120
121
122
123HTTP/1.1 200 OK
124Date: Sun, 05 Aug 2007 19:16:44 GMT
125Server: Apache
126Content-Length: 2121
127Connection: close
128Content-Type: text/html
129
130<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
131<html>
132 <head>
133 <title>Index of /</title>
134 </head>
135 <body>
136<h1>Index of /</h1>
137<pre><img src="/icons/blank.gif" alt="Icon "> <a href="?C=N;O=D">Name</a> <a href="?C=M;O=A">Last modified</a> <a href="?C=S;O=A">Size</a> <a href="?C=D;O=A">Description</a><hr><img src="/icons/folder.gif" alt="[DIR]"> <a href="202-vorbereitung/">202-vorbereitung/</a> 06-Jul-2007 14:31 -
138<img src="/icons/layout.gif" alt="[ ]"> <a href="Efficient_Video_on_demand_over_Multicast.pdf">Efficient_Video_on_d..></a> 19-Dec-2006 03:17 291K
139<img src="/icons/unknown.gif" alt="[ ]"> <a href="Welcome%20Stranger!!!">Welcome Stranger!!!</a> 28-Dec-2006 03:46 0
140<img src="/icons/text.gif" alt="[TXT]"> <a href="barschel.htm">barschel.htm</a> 31-Jul-2007 02:21 44K
141<img src="/icons/folder.gif" alt="[DIR]"> <a href="bnd/">bnd/</a> 30-Dec-2006 08:59 -
142<img src="/icons/folder.gif" alt="[DIR]"> <a href="cia/">cia/</a> 28-Jun-2007 00:04 -
143<img src="/icons/layout.gif" alt="[ ]"> <a href="cisco_ccna_640-801_command_reference_guide.pdf">cisco_ccna_640-801_c..></a> 28-Dec-2006 03:48 236K
144<img src="/icons/folder.gif" alt="[DIR]"> <a href="doc/">doc/</a> 19-Sep-2006 01:43 -
145<img src="/icons/folder.gif" alt="[DIR]"> <a href="freenetproto/">freenetproto/</a> 06-Dec-2006 09:00 -
146<img src="/icons/folder.gif" alt="[DIR]"> <a href="korrupt/">korrupt/</a> 03-Jul-2007 11:57 -
147<img src="/icons/folder.gif" alt="[DIR]"> <a href="mp3_technosets/">mp3_technosets/</a> 04-Jul-2007 08:56 -
148<img src="/icons/text.gif" alt="[TXT]"> <a href="neues_von_rainald_goetz.htm">neues_von_rainald_go..></a> 21-Mar-2007 23:27 31K
149<img src="/icons/text.gif" alt="[TXT]"> <a href="neues_von_rainald_goetz0.htm">neues_von_rainald_go..></a> 21-Mar-2007 23:29 36K
150<img src="/icons/layout.gif" alt="[ ]"> <a href="pruef.pdf">pruef.pdf</a> 28-Dec-2006 07:48 88K
151<hr></pre>
152</body></html>
153```
154
155Chaining plugins to view flow data for a specific country code in [sample traffic](http://wiki.wireshark.org/SampleCaptures#General_.2F_Unsorted) (note: TCP handshakes are not included in the packet count)
156
157```
158Dshell> decode -p country+netflow --country_code=JP ~/pcap/SkypeIRC.cap
1592006-08-25 15:32:20.766761 192.168.1.2 -> 202.232.205.123 (-- -> JP) UDP 60583 33438 1 0 64 0 0.0000s
1602006-08-25 15:32:20.634046 192.168.1.2 -> 202.232.205.123 (-- -> JP) UDP 60583 33435 1 0 64 0 0.0000s
1612006-08-25 15:32:20.747503 192.168.1.2 -> 202.232.205.123 (-- -> JP) UDP 60583 33437 1 0 64 0 0.0000s
1622006-08-25 15:32:20.651501 192.168.1.2 -> 202.232.205.123 (-- -> JP) UDP 60583 33436 1 0 64 0 0.0000s
163```
164
165Collecting DNS traffic from several files and storing it in a new pcap file.
166
167```
168Dshell> decode -p dns+pcapwriter --pcapwriter_outfile=test.pcap ~/pcap/*.cap >/dev/null
169Dshell> tcpdump -nnr test.pcap |head
170reading from file test.pcap, link-type EN10MB (Ethernet)
17115:36:08.670569 IP 192.168.1.2.2131 > 192.168.1.1.53: 40209+ A? ui.skype.com. (30)
17215:36:08.670687 IP 192.168.1.2.2131 > 192.168.1.1.53: 40210+ AAAA? ui.skype.com. (30)
17315:36:08.674022 IP 192.168.1.1.53 > 192.168.1.2.2131: 40209- 1/0/0 A 212.72.49.131 (46)
17415:36:09.011208 IP 192.168.1.1.53 > 192.168.1.2.2131: 40210 0/1/0 (94)
17515:36:10.171350 IP 192.168.1.2.2131 > 192.168.1.1.53: 40210+ AAAA? ui.skype.com. (30)
17615:36:10.961350 IP 192.168.1.1.53 > 192.168.1.2.2131: 40210* 0/1/0 (85)
17715:36:10.961608 IP 192.168.1.2.2131 > 192.168.1.1.53: 40211+ AAAA? ui.skype.com. (30)
17815:36:11.294333 IP 192.168.1.1.53 > 192.168.1.2.2131: 40211 0/1/0 (94)
17915:32:21.664798 IP 192.168.1.2.2130 > 192.168.1.1.53: 39862+ A? ui.skype.com. (30)
18015:32:21.664913 IP 192.168.1.2.2130 > 192.168.1.1.53: 39863+ AAAA? ui.skype.com. (30)
181```
182
183Collecting TFTP data and converting alerts to JSON format using [sample traffic](https://wiki.wireshark.org/SampleCaptures#TFTP)
184
185```
186Dshell> decode -p tftp -O jsonout ~/pcap/tftp_*.pcap
187{"dport": 3445, "dip": "192.168.0.10", "data": "read rfc1350.txt (24599 bytes) ", "sport": 50618, "readwrite": "read", "sip": "192.168.0.253", "plugin": "tftp", "ts": 1367411051.972852, "filename": "rfc1350.txt"}
188{"dport": 2087, "dip": "192.168.0.13", "data": "write rfc1350.txt (24599 bytes) ", "sport": 57509, "readwrite": "write", "sip": "192.168.0.1", "plugin": "tftp", "ts": 1367053679.45274, "filename": "rfc1350.txt"}
189```
190
191Running a plugin within a separate Python script using [sample traffic](https://wiki.wireshark.org/SampleCaptures#TFTP)
192
193```
194# Import required Dshell libraries
195import dshell.decode as decode
196import dshell.plugins.tftp.tftp as tftp
197
198# Instantiate plugin
199plugin = tftp.DshellPlugin()
200# Define plugin-specific arguments, if needed
201dargs = {plugin: {"outdir": "/tmp/"}}
202# Add plugin(s) to plugin chain
203decode.plugin_chain = [plugin]
204# Run decode main function with all other arguments
205decode.main(
206 debug=True,
207 files=["/home/user/pcap/tftp_rrq.pcap", "/home/user/pcap/tftp_wrq.pcap"],
208 plugin_args=dargs
209)
210```
211
README.md
1# Dshell
2An extensible network forensic analysis framework. Enables rapid development of plugins to support the dissection of network packet captures.
3
4Key features:
5* Deep packet analysis using specialized plugins
6* Robust stream reassembly
7* IPv4 and IPv6 support
8* Custom output handlers
9* Chainable plugins
10
11## Requirements
12* Linux (developed on Red Hat Enterprise Linux 6.7)
13* Python 3 (developed with Python 3.6.2)
14* [pypacker](https://gitlab.com/mike01/pypacker)
15* [pcapy](https://github.com/helpsystems/pcapy)
16* [pyOpenSSL](https://github.com/pyca/pyopenssl)
17* [geoip2](https://github.com/maxmind/GeoIP2-python)
18 * [MaxMind GeoIP2 datasets](https://dev.maxmind.com/geoip/geoip2/geolite2/)
19
20## Optional
21* [oui.txt](http://standards-oui.ieee.org/oui.txt)
22 * used by some plugins that handle MAC addresses
23 * place in <dshell>/data/
24* [elasticsearch](https://www.elastic.co/guide/en/elasticsearch/client/python-api/current/index.html)
25 * used in the elasticout output module
26 * only necessary if planning to use elasticsearch to store output
27* [pyJA3](https://github.com/salesforce/ja3/tree/master/python)
28 * used in the tls plugin
29
30## Major Changes Since Previous Release
31* This is a major framework update to Dshell. Plugins written for the previous version are not compatible with this version, and vice versa.
32* Uses Python 3
33 * Rewritten in Python 3 from the ground up. Python 2 language deprecated on [1 JAN 2020](https://www.python.org/doc/sunset-python-2/)
34 * By extension, dpkt and pypcap have been replaced with Python3-friendly pypacker and pcapy (respectively).
35* Is a Python package
36 * Converted into a single package, removing the need for the shell to set several environment variables.
37 * Allows easier use of Dshell plugins in other Python scripts
38* Changed "decoders" to "plugins"
39 * Primarily a word-swap, to clarify that "decoders" can do more than simply decode traffic, and to put Dshell more in line with the terminology of other frameworks.
40* Significant reduction in camelCase functions, replaced with more Pythonic snake\_case functions.
41 * Notable examples include blobHandler->blob\_handler, rawHandler->raw\_handler, connectionInitHandler->connection\_init\_handler, etc.
42* All plugins are now chainable
43 * To accommodate this, handler functions in plugins must now use return statements indicating whether a packet, connection, or similar will continue to the next plugin. The type of object(s) to return depends on the type of handler, but will generally match the types of the handler's input. Dshell will display a warning if it's not the right type.
44* Plugins can now use all output modules<sup>\*</sup> available to the command line switch, -O
45 * That does not mean every output module will be _useful_ to every plugin (e.g. using netflow output for a plugin that looks at individual packets), but they are available.
46 * alert(), write(), and dump() are now the same function: write()
47 * Output modules can be listed with a new flag in decode.py, --list-output or --lo
48 * Arguments for output modules are now passed with the --oargs command-line argument
49 * \* pcapout is (currently) the exception to this rule. A method has yet to arise that allows it to work with connection-based plugins
50* No more dObj declaration
51 * decode.py just looks for the class named DshellPlugin and creates an instance of that
52* Improved error handling
53 * Dshell handles more of the most common exceptions during everyday use
54* Enables development of external plugin packs, allowing the sharing and installation of new, externally-developed plugins without overlapping the core Dshell libraries.
55
56## Installation
57
581. Install Dshell with pip
59 * `sudo python3 -m pip install Dshell/` OR `sudo python3 -m pip install <Dshell-tarball>`
602. Configure geoip2 by moving the MaxMind data files (GeoLite2-ASN.mmdb, GeoLite2-City.mmdb, GeoLite2-Country.mmdb) to <install-location>/data/GeoIP/
613. Run `dshell`. This should drop you into a `Dshell> ` prompt.
62
63## Basic Usage
64
65* `decode -l`
66 * This will list all available plugins, alongside basic information about them
67* `decode -h`
68 * Show generic command-line flags available to most plugins
69* `decode -p <plugin>`
70 * Display information about a plugin, including available command line flags
71* `decode -p <plugin> <pcap>`
72 * Run the selected plugin on a pcap file
73* `decode -p <plugin1>+<plugin2> <pcap>`
74 * Chain two (or more) plugins together and run them on a pcap file
75* `decode -p <plugin> -i <interface>`
76 * Run the selected plugin live on an interface (may require superuser privileges)
77
78## Usage Examples
79Showing DNS lookups in [sample traffic](http://wiki.wireshark.org/SampleCaptures#General_.2F_Unsorted)
80
81```
82Dshell> decode -p dns ~/pcap/dns.cap |sort
83[DNS] 2005-03-30 03:47:46 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 4146, TXT? google.com., TXT: b'\x0fv=spf1 ptr ?all' **
84[DNS] 2005-03-30 03:47:50 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 63343, MX? google.com., MX: b'\x00(\x05smtp4\xc0\x0c', MX: b'\x00\n\x05smtp5\xc0\x0c', MX: b'\x00\n\x05smtp6\xc0\x0c', MX: b'\x00\n\x05smtp1\xc0\x0c', MX: b'\x00\n\x05smtp2\xc0\x0c', MX: b'\x00(\x05smtp3\xc0\x0c' **
85[DNS] 2005-03-30 03:47:59 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 18849, LOC? google.com. **
86[DNS] 2005-03-30 03:48:07 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 39867, PTR? 104.9.192.66.in-addr.arpa., PTR: 66-192-9-104.gen.twtelecom.net. **
87[DNS] 2005-03-30 03:49:18 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 30144, A? www.netbsd.org., A: 204.152.190.12 (ttl 82159s) **
88[DNS] 2005-03-30 03:49:35 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 61652, AAAA? www.netbsd.org., AAAA: 2001:4f8:4:7:2e0:81ff:fe52:9a6b (ttl 86400s) **
89[DNS] 2005-03-30 03:50:35 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 32569, AAAA? www.netbsd.org., AAAA: 2001:4f8:4:7:2e0:81ff:fe52:9a6b (ttl 86340s) **
90[DNS] 2005-03-30 03:50:44 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 36275, AAAA? www.google.com., CNAME: 'www.l.google.com.' **
91[DNS] 2005-03-30 03:50:54 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 56482, AAAA? www.l.google.com. **
92[DNS] 2005-03-30 03:51:35 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 48159, AAAA? www.example.com. **
93[DNS] 2005-03-30 03:51:46 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 9837, AAAA? www.example.notginh., NXDOMAIN **
94[DNS] 2005-03-30 03:52:17 192.168.170.8:32795 -- 192.168.170.20:53 ** ID: 65251, AAAA: 2001:4f8:0:2::d (ttl 600s), A: 204.152.184.88 (ttl 600s) **
95[DNS] 2005-03-30 03:52:17 192.168.170.8:32796 -- 192.168.170.20:53 ** ID: 23123, PTR? 1.0.0.127.in-addr.arpa., PTR: localhost. **
96[DNS] 2005-03-30 03:52:17 192.168.170.8:32797 -- 192.168.170.20:53 ** ID: 8330, NS: b'\x06ns-ext\x04nrt1\xc0\x0c', NS: b'\x06ns-ext\x04sth1\xc0\x0c', NS: b'\x06ns-ext\xc0\x0c', NS: b'\x06ns-ext\x04lga1\xc0\x0c' **
97[DNS] 2005-03-30 03:52:17 192.168.170.56:1707 -- 217.13.4.24:53 ** ID: 12910, SRV? _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.utelsystems.local., NXDOMAIN **
98[DNS] 2005-03-30 03:52:17 192.168.170.56:1708 -- 217.13.4.24:53 ** ID: 61793, SRV? _ldap._tcp.dc._msdcs.utelsystems.local., NXDOMAIN **
99[DNS] 2005-03-30 03:52:17 192.168.170.56:1709 -- 217.13.4.24:53 ** ID: 33633, SRV? _ldap._tcp.05b5292b-34b8-4fb7-85a3-8beef5fd2069.domains._msdcs.utelsystems.local., NXDOMAIN **
100[DNS] 2005-03-30 03:52:17 192.168.170.56:1710 -- 217.13.4.24:53 ** ID: 53344, A? GRIMM.utelsystems.local., NXDOMAIN **
101[DNS] 2005-03-30 03:52:25 192.168.170.56:1711 -- 217.13.4.24:53 ** ID: 30307, A? GRIMM.utelsystems.local., NXDOMAIN **
102```
103
104Following and reassembling a stream in [sample traffic](http://wiki.wireshark.org/SampleCaptures#General_.2F_Unsorted)
105
106```
107Dshell> decode -p followstream ~/pcap/v6-http.cap
108Connection 1 (TCP)
109Start: 2007-08-05 15:16:44.189851
110End: 2007-08-05 15:16:44.219460
1112001:6f8:102d:0:2d0:9ff:fee3:e8de: 59201 -> 2001:6f8:900:7c0::2: 80 (300 bytes)
1122001:6f8:900:7c0::2: 80 -> 2001:6f8:102d:0:2d0:9ff:fee3:e8de: 59201 (2379 bytes)
113
114GET / HTTP/1.0
115Host: cl-1985.ham-01.de.sixxs.net
116Accept: text/html, text/plain, text/css, text/sgml, */*;q=0.01
117Accept-Encoding: gzip, bzip2
118Accept-Language: en
119User-Agent: Lynx/2.8.6rel.2 libwww-FM/2.14 SSL-MM/1.4.1 OpenSSL/0.9.8b
120
121
122
123HTTP/1.1 200 OK
124Date: Sun, 05 Aug 2007 19:16:44 GMT
125Server: Apache
126Content-Length: 2121
127Connection: close
128Content-Type: text/html
129
130<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
131<html>
132 <head>
133 <title>Index of /</title>
134 </head>
135 <body>
136<h1>Index of /</h1>
137<pre><img src="/icons/blank.gif" alt="Icon "> <a href="?C=N;O=D">Name</a> <a href="?C=M;O=A">Last modified</a> <a href="?C=S;O=A">Size</a> <a href="?C=D;O=A">Description</a><hr><img src="/icons/folder.gif" alt="[DIR]"> <a href="202-vorbereitung/">202-vorbereitung/</a> 06-Jul-2007 14:31 -
138<img src="/icons/layout.gif" alt="[ ]"> <a href="Efficient_Video_on_demand_over_Multicast.pdf">Efficient_Video_on_d..></a> 19-Dec-2006 03:17 291K
139<img src="/icons/unknown.gif" alt="[ ]"> <a href="Welcome%20Stranger!!!">Welcome Stranger!!!</a> 28-Dec-2006 03:46 0
140<img src="/icons/text.gif" alt="[TXT]"> <a href="barschel.htm">barschel.htm</a> 31-Jul-2007 02:21 44K
141<img src="/icons/folder.gif" alt="[DIR]"> <a href="bnd/">bnd/</a> 30-Dec-2006 08:59 -
142<img src="/icons/folder.gif" alt="[DIR]"> <a href="cia/">cia/</a> 28-Jun-2007 00:04 -
143<img src="/icons/layout.gif" alt="[ ]"> <a href="cisco_ccna_640-801_command_reference_guide.pdf">cisco_ccna_640-801_c..></a> 28-Dec-2006 03:48 236K
144<img src="/icons/folder.gif" alt="[DIR]"> <a href="doc/">doc/</a> 19-Sep-2006 01:43 -
145<img src="/icons/folder.gif" alt="[DIR]"> <a href="freenetproto/">freenetproto/</a> 06-Dec-2006 09:00 -
146<img src="/icons/folder.gif" alt="[DIR]"> <a href="korrupt/">korrupt/</a> 03-Jul-2007 11:57 -
147<img src="/icons/folder.gif" alt="[DIR]"> <a href="mp3_technosets/">mp3_technosets/</a> 04-Jul-2007 08:56 -
148<img src="/icons/text.gif" alt="[TXT]"> <a href="neues_von_rainald_goetz.htm">neues_von_rainald_go..></a> 21-Mar-2007 23:27 31K
149<img src="/icons/text.gif" alt="[TXT]"> <a href="neues_von_rainald_goetz0.htm">neues_von_rainald_go..></a> 21-Mar-2007 23:29 36K
150<img src="/icons/layout.gif" alt="[ ]"> <a href="pruef.pdf">pruef.pdf</a> 28-Dec-2006 07:48 88K
151<hr></pre>
152</body></html>
153```
154
155Chaining plugins to view flow data for a specific country code in [sample traffic](http://wiki.wireshark.org/SampleCaptures#General_.2F_Unsorted) (note: TCP handshakes are not included in the packet count)
156
157```
158Dshell> decode -p country+netflow --country_code=JP ~/pcap/SkypeIRC.cap
1592006-08-25 15:32:20.766761 192.168.1.2 -> 202.232.205.123 (-- -> JP) UDP 60583 33438 1 0 64 0 0.0000s
1602006-08-25 15:32:20.634046 192.168.1.2 -> 202.232.205.123 (-- -> JP) UDP 60583 33435 1 0 64 0 0.0000s
1612006-08-25 15:32:20.747503 192.168.1.2 -> 202.232.205.123 (-- -> JP) UDP 60583 33437 1 0 64 0 0.0000s
1622006-08-25 15:32:20.651501 192.168.1.2 -> 202.232.205.123 (-- -> JP) UDP 60583 33436 1 0 64 0 0.0000s
163```
164
165Collecting DNS traffic from several files and storing it in a new pcap file.
166
167```
168Dshell> decode -p dns+pcapwriter --pcapwriter_outfile=test.pcap ~/pcap/*.cap >/dev/null
169Dshell> tcpdump -nnr test.pcap |head
170reading from file test.pcap, link-type EN10MB (Ethernet)
17115:36:08.670569 IP 192.168.1.2.2131 > 192.168.1.1.53: 40209+ A? ui.skype.com. (30)
17215:36:08.670687 IP 192.168.1.2.2131 > 192.168.1.1.53: 40210+ AAAA? ui.skype.com. (30)
17315:36:08.674022 IP 192.168.1.1.53 > 192.168.1.2.2131: 40209- 1/0/0 A 212.72.49.131 (46)
17415:36:09.011208 IP 192.168.1.1.53 > 192.168.1.2.2131: 40210 0/1/0 (94)
17515:36:10.171350 IP 192.168.1.2.2131 > 192.168.1.1.53: 40210+ AAAA? ui.skype.com. (30)
17615:36:10.961350 IP 192.168.1.1.53 > 192.168.1.2.2131: 40210* 0/1/0 (85)
17715:36:10.961608 IP 192.168.1.2.2131 > 192.168.1.1.53: 40211+ AAAA? ui.skype.com. (30)
17815:36:11.294333 IP 192.168.1.1.53 > 192.168.1.2.2131: 40211 0/1/0 (94)
17915:32:21.664798 IP 192.168.1.2.2130 > 192.168.1.1.53: 39862+ A? ui.skype.com. (30)
18015:32:21.664913 IP 192.168.1.2.2130 > 192.168.1.1.53: 39863+ AAAA? ui.skype.com. (30)
181```
182
183Collecting TFTP data and converting alerts to JSON format using [sample traffic](https://wiki.wireshark.org/SampleCaptures#TFTP)
184
185```
186Dshell> decode -p tftp -O jsonout ~/pcap/tftp_*.pcap
187{"dport": 3445, "dip": "192.168.0.10", "data": "read rfc1350.txt (24599 bytes) ", "sport": 50618, "readwrite": "read", "sip": "192.168.0.253", "plugin": "tftp", "ts": 1367411051.972852, "filename": "rfc1350.txt"}
188{"dport": 2087, "dip": "192.168.0.13", "data": "write rfc1350.txt (24599 bytes) ", "sport": 57509, "readwrite": "write", "sip": "192.168.0.1", "plugin": "tftp", "ts": 1367053679.45274, "filename": "rfc1350.txt"}
189```
190
191Running a plugin within a separate Python script using [sample traffic](https://wiki.wireshark.org/SampleCaptures#TFTP)
192
193```
194# Import required Dshell libraries
195import dshell.decode as decode
196import dshell.plugins.tftp.tftp as tftp
197
198# Instantiate plugin
199plugin = tftp.DshellPlugin()
200# Define plugin-specific arguments, if needed
201dargs = {plugin: {"outdir": "/tmp/"}}
202# Add plugin(s) to plugin chain
203decode.plugin_chain = [plugin]
204# Run decode main function with all other arguments
205decode.main(
206 debug=True,
207 files=["/home/user/pcap/tftp_rrq.pcap", "/home/user/pcap/tftp_wrq.pcap"],
208 plugin_args=dargs
209)
210```
211
