3 Converts netscreen snoop hex-dumps to a hex-dump that text2pcap can read.
7 Copyright (c) 2004 by Gilbert Ramirez <gram@alumni.rice.edu>
9 This program is free software; you can redistribute it and/or
10 modify it under the terms of the GNU General Public License
11 as published by the Free Software Foundation; either version 2
12 of the License, or (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
33 def __init__(self, name, base_time):
35 self.fh = open(name, "w")
39 self.base_time = base_time
40 self.prev_timestamp = 0.0
42 def PrintPacket(self, timestamp, datalines):
43 # What do to with the timestamp? I need more data about what
44 # the netscreen timestamp is, then I can generate one for the text file.
45 # print "TS:", timestamp.group("time")
47 timestamp = float(timestamp.group("time"))
49 sys.exit("Unable to convert '%s' to floating point." % \
52 # Did we wrap around the timeer max?
53 if timestamp < self.prev_timestamp:
54 self.base_time += self.TIMER_MAX
56 self.prev_timestamp = timestamp
58 packet_timestamp = self.base_time + timestamp
60 # Determine the time string to print
61 gmtime = time.gmtime(packet_timestamp)
62 subsecs = packet_timestamp - int(packet_timestamp)
64 subsecs = int(subsecs * 10)
66 print >> self.fh, "%s.%d" % (time.strftime("%Y-%m-%d %H:%M:%S", gmtime), \
69 # Print the packet data
71 for lineno, hexgroup in datalines:
72 hexline = hexgroup.group("hex")
73 hexpairs = hexline.split()
74 print >> self.fh, "%08x %s" % (offset, hexline)
75 offset += len(hexpairs)
80 # Find a timestamp line
81 re_timestamp = re.compile(r"^(?P<time>\d+\.\d): [\w/]+\((?P<io>.)\)(:| len=)")
83 # Find a hex dump line
84 re_hex_line = re.compile(r"(?P<hex>([0-9a-f]{2} ){1,16})\s+(?P<ascii>.){1,16}")
86 def run(input_filename, output_filename):
88 ifh = open(input_filename, "r")
92 # Get the file's creation time.
94 ctime = os.stat(input_filename)[stat.ST_CTIME]
98 output_file = OutputFile(output_filename, ctime)
104 for line in ifh.xreadlines():
106 # If we have no timestamp yet, look for one
108 m = re_timestamp.search(line)
112 # Otherwise, look for hex dump lines
114 m = re_hex_line.search(line)
116 datalines.append((lineno, m))
118 # If we have been gathering hex dump lines,
119 # and this line is not a hex dump line, then the hex dump
120 # has finished, and so has the packet. So print the packet
121 # and reset our variables so we can look for the next packet.
123 output_file.PrintPacket(timestamp, datalines)
127 # At the end of the file we may still have hex dump data in memory.
128 # If so, print the packet
130 output_file.PrintPacket(timestamp, datalines)
136 print >> sys.stderr, "Usage: netscreen2dump.py netscreen-dump-file new-dump-file"
140 if len(sys.argv) != 3:
143 run(sys.argv[1], sys.argv[2])
145 if __name__ == "__main__":