python - 如何为 PCAP 文件中 IP 地址的每次流量、传入和传出流量绘制折线图

Question

我想使用 Python 绘制来自 PCAP 文件的 IP 地址的传入流量和传出流量的折线图

首先，我将选择一个 IP 地址，例如“发送数据的最高 IP”。我用这个功能做到这一点：

from scapy.all import *
import matplotlib.pyplot as plt
import pyx
name-file = rdpcap('test.pcap')

def topSources(name-file):
 
count_source={} #dictionary of {IP_adress: number_paquets_send-for this IP ...}
                # example {192.168.2.1 : 234, 192.188.2.4 : 45 }
for line in open(name,'r').readlines():
    src=line.split(",")[2]
    if src not in count_source:
        count_source[src]=1
    else:
        count_source[src]+=1
        
max_IP = max(count_source, key = count_source.get) 
return max_IP #max_IP return 192.168.2.1 

现在我想做这些步骤：

1- 将这个 IP 每秒发送的数据包的大小（以字节或位为单位）相加。这将给出传入流量

2- 将此 IP 每秒接收的数据包的大小（以字节或位为单位）相加。它将为您提供传出流量

3- 图表传入流量（以字节或位为单位）与时间（秒）

4-图表传出流量（以字节或位为单位）与时间（秒）

为此，它们在我的 pcap 这些信息中（我不知道我们如何使用它来完成我想要的任务）

|bidirectional_first_seen_ms|   int|    Timestamp in milliseconds on first flow bidirectional packet.|
|bidirectional_last_seen_ms|    int|    Timestamp in milliseconds on last flow bidirectional packet.|
|bidirectional_duration_ms|     int|    Flow bidirectional duration in milliseconds.|
|bidirectional_packets|         int|    Flow bidirectional packets accumulator.|
|bidirectional_bytes|           int|    Flow bidirectional bytes accumulator (depends on accounting_mode).|
|src2dst_first_seen_ms|         int|    Timestamp in milliseconds on first flow src2dst packet.|
|src2dst_last_seen_ms|          int|    Timestamp in milliseconds on last flow src2dst packet.|
|src2dst_duration_ms|           int|    Flow src2dst duration in milliseconds.|
|src2dst_packets|               int|    Flow src2dst packets accumulator.|
|src2dst_bytes|                 int|    Flow src2dst bytes accumulator (depends on accounting_mode).|
|dst2src_first_seen_ms|         int|    Timestamp in milliseconds on first flow dst2src packet.|
|dst2src_last_seen_ms|          int|    Timestamp in milliseconds on last flow dst2src packet.|
|dst2src_duration_ms|           int|    Flow dst2src duration in milliseconds.|
|dst2src_packets|               int|    Flow dst2src packets accumulator.|
|dst2src_bytes|                 int|    Flow dst2src bytes accumulator (depends on accounting_mode). |

总之，我想要这样的图形：

标签： pythonmatplotlibscapypcapnetwork-monitoring