A flexible and powerful network data analysis library
Project description
nfstream is a flexible and lightweight network data analysis library.
nfstream main features
Performance: nfstream was designed to be fast, CPU savvy and small memory fingerprint.
Layer-7 visibility: nfstream dissection is based on nDPI (~300 applications including Tor, Messenger, WhatsApp, etc.).
Flexibility: add a flow metric in 2 lines of code using nfstream plugins method.
examples of use
Dealing with a big pcap file and just want to see flow informations stored in as a csv file or pandas Dataframe? nfstream make this path easier in few lines:
from nfstream.streamer import Streamer
my_capture_streamer = Streamer(source="instagram.pcap",
capacity=128000,
active_timeout=120,
inactive_timeout=60)
my_live_streamer = Streamer(source="eth1") # or capture from a network interface
for flow in my_capture_streamer: # or for flow in my_live_streamer
print(flow) # print, append to pandas Dataframe or whatever you want :)!
{"ip_src": "192.168.122.121",
"src_port": 43277,
"ip_dst": "186.102.189.33",
"dst_port": 443,
"ip_protocol": 6,
"src_to_dst_pkts": 6,
"dst_to_src_pkts": 5,
"src_to_dst_bytes": 1456,
"dst_to_src_bytes": 477,
"application_name": "TLS.Instagram",
"category_name": "SocialNetwork",
"start_time": 1555969081636,
"end_time": 1555969082020,
"export_reason": 2}
Didn’t find a specific flow feature? add it to Streamer as a plugin in few lines:
from nfstream.streamer import Streamer
def my_awesome_plugin(packet_information, flow):
if packet_information.size > 666:
flow.metrics['count_pkts_gt_666'] += 1
return flow
streamer_awesome = Streamer(source='devil.pcap',
user_metrics={'count_pkts_gt_666': my_awesome_plugin})
for flow in streamer_awesome:
# now you will see your created metric in generated flows
print(flow.metrics['count_pkts_gt_666'])
More example and details are provided on the official Documentation.
Getting Started
Prerequisites
apt-get install python-dev libpcap-dev autogen
Installation
using pip
Binary installers for the latest released version are available:
pip3 install nfstream
from source
If you want to build nfstream on your local machine:
apt-get autogen
git clone https://github.com/aouinizied/nfstream.git
# move to nfstream directory and run
python3 setup.py install
Contributing
Please read Contributing for details on our code of conduct, and the process for submitting pull requests to us.
License
This project is licensed under the GPLv3 License - see the License file for details
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
File details
Details for the file nfstream-0.4.0.tar.gz
.
File metadata
- Download URL: nfstream-0.4.0.tar.gz
- Upload date:
- Size: 672.2 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/2.0.0 pkginfo/1.5.0.1 requests/2.22.0 setuptools/41.4.0 requests-toolbelt/0.9.1 tqdm/4.36.1 CPython/3.6.7
File hashes
Algorithm | Hash digest | |
---|---|---|
SHA256 | f47d61f6ae325373ea13c0935b55c2951df31d94ff818fe0a9e4fd7ee5e016a2 |
|
MD5 | 190ff5ac421567455fdee3c91483b907 |
|
BLAKE2b-256 | 3716b68ef6e7b92485fd52d1a0e4043a5dfe86186dbb0bf3ba1c5d95f6528b31 |
File details
Details for the file nfstream-0.4.0-py2.py3-none-any.whl
.
File metadata
- Download URL: nfstream-0.4.0-py2.py3-none-any.whl
- Upload date:
- Size: 683.0 kB
- Tags: Python 2, Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/2.0.0 pkginfo/1.5.0.1 requests/2.22.0 setuptools/41.4.0 requests-toolbelt/0.9.1 tqdm/4.36.1 CPython/3.6.7
File hashes
Algorithm | Hash digest | |
---|---|---|
SHA256 | 26b57cd9a7b7e486d22f42b39d4f1f7cf8542cd2fa607f40c38ecf56d31b0031 |
|
MD5 | f408916cf9098c994700a372cd65be40 |
|
BLAKE2b-256 | b0bfa9d7bd9ddba684ffe1c965269fa3b642e5d28042f0128a1ffe37ecdb67db |