tools/netscreen2dump.py

   1 #!/usr/bin/env python
   2 """
   3 Converts netscreen snoop hex-dumps to a hex-dump that text2pcap can read.
   4
   5 Copyright (c) 2004 by Gilbert Ramirez <gram@alumni.rice.edu>
   6
   7 This program is free software; you can redistribute it and/or
   8 modify it under the terms of the GNU General Public License
   9 as published by the Free Software Foundation; either version 2
  10 of the License, or (at your option) any later version.
  11
  12 This program is distributed in the hope that it will be useful,
  13 but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 GNU General Public License for more details.
  16
  17 You should have received a copy of the GNU General Public License
  18 along with this program; if not, write to the Free Software
  19 Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  20 """
  21
  22 import sys
  23 import re
  24 import os
  25 import stat
  26 import time
  27
  28 class OutputFile:
  29     TIMER_MAX = 99999.9
  30
  31     def __init__(self, name, base_time):
  32         try:
  33             self.fh = open(name, "w")
  34         except IOError, err:
  35             sys.exit(err)
  36
  37         self.base_time = base_time
  38         self.prev_timestamp = 0.0
  39
  40     def PrintPacket(self, timestamp, datalines):
  41         # What do to with the timestamp? I need more data about what
  42         # the netscreen timestamp is, then I can generate one for the text file.
  43 #        print "TS:", timestamp.group("time")
  44         try:
  45             timestamp = float(timestamp.group("time"))
  46         except ValueError:
  47             sys.exit("Unable to convert '%s' to floating point." % \
  48                     (timestamp,))
  49
  50         # Did we wrap around the timeer max?
  51         if timestamp < self.prev_timestamp:
  52             self.base_time += self.TIMER_MAX
  53
  54         self.prev_timestamp = timestamp
  55
  56         packet_timestamp = self.base_time + timestamp
  57
  58         # Determine the time string to print
  59         gmtime = time.gmtime(packet_timestamp)
  60         subsecs = packet_timestamp - int(packet_timestamp)
  61         assert subsecs <= 0
  62         subsecs = int(subsecs * 10)
  63
  64         print >> self.fh, "%s.%d" % (time.strftime("%Y-%m-%d %H:%M:%S", gmtime), \
  65                 subsecs)
  66
  67         # Print the packet data
  68         offset = 0
  69         for lineno, hexgroup in datalines:
  70             hexline = hexgroup.group("hex")
  71             hexpairs = hexline.split()
  72             print >> self.fh, "%08x   %s" % (offset, hexline)
  73             offset += len(hexpairs)
  74
  75         # Blank line
  76         print >> self.fh
  77
  78 re_timestamp = re.compile(r"^(?P<time>\d+\.\d): \d+\((?P<io>.)\):")
  79 re_hex_line = re.compile(r"(?P<hex>([0-9a-f]{2} ){1,16})\s+(?P<ascii>.){1,16}")
  80
  81 def run(input_filename, output_filename):
  82     try:
  83         ifh = open(input_filename, "r")
  84     except IOError, err:
  85         sys.exit(err)
  86
  87     try:
  88         ctime = os.stat(input_filename)[stat.ST_CTIME]
  89     except OSError, err:
  90         sys.exit(err)
  91
  92     output_file = OutputFile(output_filename, ctime)
  93
  94     timestamp = None
  95     datalines = []
  96     lineno = 0
  97
  98     for line in ifh.xreadlines():
  99         lineno += 1
 100         if not timestamp:
 101             m = re_timestamp.search(line)
 102             if m:
 103                 timestamp = m
 104
 105         else:
 106             m = re_hex_line.search(line)
 107             if m:
 108                 datalines.append((lineno, m))
 109             else:
 110                 if datalines:
 111                     output_file.PrintPacket(timestamp, datalines)
 112                     timestamp = None
 113                     datalines = []
 114
 115     if datalines:
 116         output_file.PrintPacket(timestamp, datalines)
 117         timestamp = None
 118         datalines = []
 119
 120
 121 def usage():
 122     print >> sys.stderr, "Usage: netscreen2dump.py netscreen-dump-file new-dump-file"
 123     sys.exit(1)
 124
 125 def main():
 126     if len(sys.argv) != 3:
 127         usage()
 128
 129     run(sys.argv[1], sys.argv[2])
 130
 131 if __name__ == "__main__":
 132     main()