| | |
- __builtin__.object
-
- Output
-
- DBOutput
- FileOutput
-
- PCAPWriter
- TextOutput
- QueueOutput
- SessionWriter
class DBOutput(Output) |
| |
format strings as used by the DBOutput module to create tables and map fields
these follow the usual %(name)type and in most cases a custom format string will work
defualt type maps are:
s,r = VARCHAR (if field len given) /TEXT (if no len)
c = CHAR(1)
x,X,o = VARCHAR
d,i,u = INTEGER
e,E,f,F,g,G = DECIMAL
with the following extra: (using these breaks text format string compatibility)
b = boolean
t = timestamp
D = datetime
T = this field selects table
(following are postgres-only)
A = inet
H = host
N = cidr
M = macaddr
format string can also map field to column with %(field:column)type
or specify an explicit column type with %(field:column)pytype:DBTYPE
(note this also breaks compatibility with text format strings)
|
| |
- Method resolution order:
- DBOutput
- Output
- __builtin__.object
Methods defined here:
- __init__(self, *args, **kw)
- configuration:
config=db config .ini file name to parse
config keywords:
dbtype=database type, selects DB API module to load
in conf file use [dbtype] section name instead
host,user,passwd,password,db,database,port will be passed to db module if present
table=db table to use if not specified by a field
insert_param=character to use as parameter placeholder for INSERT
(sqlite3=?, default=%%s)
format_types=types to format before insert (default=x)
('s' to pad strings, 'x' to convert to hex, 'f' to format floats, 'fx' for hex and floats...)
- alert(self, *args, **kw)
- write an output record
we pass in the decoder object and args/dict
- close(self)
- closes database connection
- createtable(self, table=None)
- creates a table based on the format string
- insert(self, rec, table=None)
- inserts rec dict using self.format into table (if given, else default or specified by field)
if insert fails, tries to create table and insert again before raising exception
- setformat(self, formatstr=None)
- calls main setformat and then builds the insert SQL
Methods inherited from Output:
- dispatch(self, m, *args, **kwargs)
- dispatch from Q pop
- dump(self, pkt=None, **kw)
- dump raw packet data to an output
override this if you want a format other than pcap
- log(self, msg, level=20, *args, **kw)
- write a message to the log
passes all args and kwargs thru to logging
except for level= is used to set logging level
- parse(self, *args, **kw)
- parse the input args/kwargs into a record dict according to format string
- timestamps are formatted to date/time strings
- fields not in the input will be defined but blank
- extra fields in the record will be formatted into a
"name=value name2=value2..." string and put in 'extra'
- args will go into 'data'
- format keyword can contain a new format string to use (this also sets format for future output)
- setup(self)
- Perform any additional setup outside of the standard __init__.
Runs after command-line arguments are parsed, but before decoders are run.
For example, printing header data to the outfile.
Data descriptors inherited from Output:
- __dict__
- dictionary for instance variables (if defined)
- __weakref__
- list of weak references to the object (if defined)
|
class FileOutput(Output) |
| | |
- Method resolution order:
- FileOutput
- Output
- __builtin__.object
Methods defined here:
- __init__(self, *args, **kw)
- configuration for fileoutput:
fh=<existing open file handle>
file=filename to write to
mode=mode to open file as, default 'w'
- close(self)
- close output if not stdout
- write(self, obj, **kw)
- write session data to the session output or stdout
Methods inherited from Output:
- dispatch(self, m, *args, **kwargs)
- dispatch from Q pop
- dump(self, pkt=None, **kw)
- dump raw packet data to an output
override this if you want a format other than pcap
- log(self, msg, level=20, *args, **kw)
- write a message to the log
passes all args and kwargs thru to logging
except for level= is used to set logging level
- parse(self, *args, **kw)
- parse the input args/kwargs into a record dict according to format string
- timestamps are formatted to date/time strings
- fields not in the input will be defined but blank
- extra fields in the record will be formatted into a
"name=value name2=value2..." string and put in 'extra'
- args will go into 'data'
- format keyword can contain a new format string to use (this also sets format for future output)
- setformat(self, formatstr=None, typemap=None)
- parse a format string and extract the field info
if no string given, reverts to default for class
will set self.fields to be a list of (name,type,spec) tuples
self.fieldnames to a list of fieldnames
and self.fieldmap to a list of key=in value=out mappings
format string can also map in field to out field with %(in:out)spectype
or specify an explicit out type with %(in:out)specintype:outtype
(note this breaks compatibility with text formatting,
but useful for db or other output modules)
a typemap of [intype]=outtype (or [in]=(newintype,outtype)
can be used to map and replace types
- setup(self)
- Perform any additional setup outside of the standard __init__.
Runs after command-line arguments are parsed, but before decoders are run.
For example, printing header data to the outfile.
Data descriptors inherited from Output:
- __dict__
- dictionary for instance variables (if defined)
- __weakref__
- list of weak references to the object (if defined)
|
class Output(__builtin__.object) |
| |
dShell output base class, extended by output types
|
| |
Methods defined here:
- __init__(self, *a, **kw)
- base output class constructor
configuration kwords:
logger=<existing logging object> to pass in a logger
format='format string' to override default formatstring for output class
pcap = filename to write pcap
- close(self)
- # close the PCAP output
- dispatch(self, m, *args, **kwargs)
- dispatch from Q pop
- dump(self, pkt=None, **kw)
- dump raw packet data to an output
override this if you want a format other than pcap
- log(self, msg, level=20, *args, **kw)
- write a message to the log
passes all args and kwargs thru to logging
except for level= is used to set logging level
- parse(self, *args, **kw)
- parse the input args/kwargs into a record dict according to format string
- timestamps are formatted to date/time strings
- fields not in the input will be defined but blank
- extra fields in the record will be formatted into a
"name=value name2=value2..." string and put in 'extra'
- args will go into 'data'
- format keyword can contain a new format string to use (this also sets format for future output)
- setformat(self, formatstr=None, typemap=None)
- parse a format string and extract the field info
if no string given, reverts to default for class
will set self.fields to be a list of (name,type,spec) tuples
self.fieldnames to a list of fieldnames
and self.fieldmap to a list of key=in value=out mappings
format string can also map in field to out field with %(in:out)spectype
or specify an explicit out type with %(in:out)specintype:outtype
(note this breaks compatibility with text formatting,
but useful for db or other output modules)
a typemap of [intype]=outtype (or [in]=(newintype,outtype)
can be used to map and replace types
- setup(self)
- Perform any additional setup outside of the standard __init__.
Runs after command-line arguments are parsed, but before decoders are run.
For example, printing header data to the outfile.
Data descriptors defined here:
- __dict__
- dictionary for instance variables (if defined)
- __weakref__
- list of weak references to the object (if defined)
|
class PCAPWriter(FileOutput) |
| |
writes a pcap file
|
| |
- Method resolution order:
- PCAPWriter
- FileOutput
- Output
- __builtin__.object
Methods defined here:
- __init__(self, *args, **kw)
- write(self, pktlen, pktdata, ts)
- # overrides Output.write to write session as PCAP
# data flow is Output.dump->pcapwriter.write
Methods inherited from FileOutput:
- close(self)
- close output if not stdout
Methods inherited from Output:
- dispatch(self, m, *args, **kwargs)
- dispatch from Q pop
- dump(self, pkt=None, **kw)
- dump raw packet data to an output
override this if you want a format other than pcap
- log(self, msg, level=20, *args, **kw)
- write a message to the log
passes all args and kwargs thru to logging
except for level= is used to set logging level
- parse(self, *args, **kw)
- parse the input args/kwargs into a record dict according to format string
- timestamps are formatted to date/time strings
- fields not in the input will be defined but blank
- extra fields in the record will be formatted into a
"name=value name2=value2..." string and put in 'extra'
- args will go into 'data'
- format keyword can contain a new format string to use (this also sets format for future output)
- setformat(self, formatstr=None, typemap=None)
- parse a format string and extract the field info
if no string given, reverts to default for class
will set self.fields to be a list of (name,type,spec) tuples
self.fieldnames to a list of fieldnames
and self.fieldmap to a list of key=in value=out mappings
format string can also map in field to out field with %(in:out)spectype
or specify an explicit out type with %(in:out)specintype:outtype
(note this breaks compatibility with text formatting,
but useful for db or other output modules)
a typemap of [intype]=outtype (or [in]=(newintype,outtype)
can be used to map and replace types
- setup(self)
- Perform any additional setup outside of the standard __init__.
Runs after command-line arguments are parsed, but before decoders are run.
For example, printing header data to the outfile.
Data descriptors inherited from Output:
- __dict__
- dictionary for instance variables (if defined)
- __weakref__
- list of weak references to the object (if defined)
|
class QueueOutput(Output) |
| |
pipes pickled packets to parent process
|
| |
- Method resolution order:
- QueueOutput
- Output
- __builtin__.object
Methods defined here:
- __init__(self, q, **kwargs)
- alert(self, *args, **kw)
- close(self)
- dispatch(self, m, *args, **kw)
- dump(self, *args, **kw)
- write(self, *args, **kw)
Methods inherited from Output:
- log(self, msg, level=20, *args, **kw)
- write a message to the log
passes all args and kwargs thru to logging
except for level= is used to set logging level
- parse(self, *args, **kw)
- parse the input args/kwargs into a record dict according to format string
- timestamps are formatted to date/time strings
- fields not in the input will be defined but blank
- extra fields in the record will be formatted into a
"name=value name2=value2..." string and put in 'extra'
- args will go into 'data'
- format keyword can contain a new format string to use (this also sets format for future output)
- setformat(self, formatstr=None, typemap=None)
- parse a format string and extract the field info
if no string given, reverts to default for class
will set self.fields to be a list of (name,type,spec) tuples
self.fieldnames to a list of fieldnames
and self.fieldmap to a list of key=in value=out mappings
format string can also map in field to out field with %(in:out)spectype
or specify an explicit out type with %(in:out)specintype:outtype
(note this breaks compatibility with text formatting,
but useful for db or other output modules)
a typemap of [intype]=outtype (or [in]=(newintype,outtype)
can be used to map and replace types
- setup(self)
- Perform any additional setup outside of the standard __init__.
Runs after command-line arguments are parsed, but before decoders are run.
For example, printing header data to the outfile.
Data descriptors inherited from Output:
- __dict__
- dictionary for instance variables (if defined)
- __weakref__
- list of weak references to the object (if defined)
|
class SessionWriter(Output) |
| |
writes the session to one or more files
|
| |
- Method resolution order:
- SessionWriter
- Output
- __builtin__.object
Methods defined here:
- __init__(self, session=None, **kw)
- write(self, obj, **kwargs)
Methods inherited from Output:
- close(self)
- # close the PCAP output
- dispatch(self, m, *args, **kwargs)
- dispatch from Q pop
- dump(self, pkt=None, **kw)
- dump raw packet data to an output
override this if you want a format other than pcap
- log(self, msg, level=20, *args, **kw)
- write a message to the log
passes all args and kwargs thru to logging
except for level= is used to set logging level
- parse(self, *args, **kw)
- parse the input args/kwargs into a record dict according to format string
- timestamps are formatted to date/time strings
- fields not in the input will be defined but blank
- extra fields in the record will be formatted into a
"name=value name2=value2..." string and put in 'extra'
- args will go into 'data'
- format keyword can contain a new format string to use (this also sets format for future output)
- setformat(self, formatstr=None, typemap=None)
- parse a format string and extract the field info
if no string given, reverts to default for class
will set self.fields to be a list of (name,type,spec) tuples
self.fieldnames to a list of fieldnames
and self.fieldmap to a list of key=in value=out mappings
format string can also map in field to out field with %(in:out)spectype
or specify an explicit out type with %(in:out)specintype:outtype
(note this breaks compatibility with text formatting,
but useful for db or other output modules)
a typemap of [intype]=outtype (or [in]=(newintype,outtype)
can be used to map and replace types
- setup(self)
- Perform any additional setup outside of the standard __init__.
Runs after command-line arguments are parsed, but before decoders are run.
For example, printing header data to the outfile.
Data descriptors inherited from Output:
- __dict__
- dictionary for instance variables (if defined)
- __weakref__
- list of weak references to the object (if defined)
|
class TextOutput(FileOutput) |
| |
formatted text output to file or stdout
|
| |
- Method resolution order:
- TextOutput
- FileOutput
- Output
- __builtin__.object
Methods defined here:
- __init__(self, *args, **kw)
- alert(self, *args, **kw)
- write an alert record
we pass in the decoder object and args/dict
Methods inherited from FileOutput:
- close(self)
- close output if not stdout
- write(self, obj, **kw)
- write session data to the session output or stdout
Methods inherited from Output:
- dispatch(self, m, *args, **kwargs)
- dispatch from Q pop
- dump(self, pkt=None, **kw)
- dump raw packet data to an output
override this if you want a format other than pcap
- log(self, msg, level=20, *args, **kw)
- write a message to the log
passes all args and kwargs thru to logging
except for level= is used to set logging level
- parse(self, *args, **kw)
- parse the input args/kwargs into a record dict according to format string
- timestamps are formatted to date/time strings
- fields not in the input will be defined but blank
- extra fields in the record will be formatted into a
"name=value name2=value2..." string and put in 'extra'
- args will go into 'data'
- format keyword can contain a new format string to use (this also sets format for future output)
- setformat(self, formatstr=None, typemap=None)
- parse a format string and extract the field info
if no string given, reverts to default for class
will set self.fields to be a list of (name,type,spec) tuples
self.fieldnames to a list of fieldnames
and self.fieldmap to a list of key=in value=out mappings
format string can also map in field to out field with %(in:out)spectype
or specify an explicit out type with %(in:out)specintype:outtype
(note this breaks compatibility with text formatting,
but useful for db or other output modules)
a typemap of [intype]=outtype (or [in]=(newintype,outtype)
can be used to map and replace types
- setup(self)
- Perform any additional setup outside of the standard __init__.
Runs after command-line arguments are parsed, but before decoders are run.
For example, printing header data to the outfile.
Data descriptors inherited from Output:
- __dict__
- dictionary for instance variables (if defined)
- __weakref__
- list of weak references to the object (if defined)
|
obj = class TextOutput(FileOutput) |
| |
formatted text output to file or stdout
|
| |
- Method resolution order:
- TextOutput
- FileOutput
- Output
- __builtin__.object
Methods defined here:
- __init__(self, *args, **kw)
- alert(self, *args, **kw)
- write an alert record
we pass in the decoder object and args/dict
Methods inherited from FileOutput:
- close(self)
- close output if not stdout
- write(self, obj, **kw)
- write session data to the session output or stdout
Methods inherited from Output:
- dispatch(self, m, *args, **kwargs)
- dispatch from Q pop
- dump(self, pkt=None, **kw)
- dump raw packet data to an output
override this if you want a format other than pcap
- log(self, msg, level=20, *args, **kw)
- write a message to the log
passes all args and kwargs thru to logging
except for level= is used to set logging level
- parse(self, *args, **kw)
- parse the input args/kwargs into a record dict according to format string
- timestamps are formatted to date/time strings
- fields not in the input will be defined but blank
- extra fields in the record will be formatted into a
"name=value name2=value2..." string and put in 'extra'
- args will go into 'data'
- format keyword can contain a new format string to use (this also sets format for future output)
- setformat(self, formatstr=None, typemap=None)
- parse a format string and extract the field info
if no string given, reverts to default for class
will set self.fields to be a list of (name,type,spec) tuples
self.fieldnames to a list of fieldnames
and self.fieldmap to a list of key=in value=out mappings
format string can also map in field to out field with %(in:out)spectype
or specify an explicit out type with %(in:out)specintype:outtype
(note this breaks compatibility with text formatting,
but useful for db or other output modules)
a typemap of [intype]=outtype (or [in]=(newintype,outtype)
can be used to map and replace types
- setup(self)
- Perform any additional setup outside of the standard __init__.
Runs after command-line arguments are parsed, but before decoders are run.
For example, printing header data to the outfile.
Data descriptors inherited from Output:
- __dict__
- dictionary for instance variables (if defined)
- __weakref__
- list of weak references to the object (if defined)
| |