Skip to main content

A flexible and powerful network data analysis library

Project description

release build coverage quality doc python license

nfstream is a flexible and lightweight network data analysis library.

nfstream main features

  • Performance: nfstream was designed to be fast, CPU savvy and small memory fingerprint.

  • Layer-7 visibility: nfstream dissection is based on nDPI (~300 applications including Tor, Messenger, WhatsApp, etc.).

  • Flexibility: add a flow metric in 2 lines of code using nfstream plugins method.

examples of use

  • Dealing with a big pcap file and just want to see flow informations stored in as a csv file or pandas Dataframe? nfstream make this path easier in few lines:

from nfstream.streamer import Streamer
my_capture_streamer = Streamer(source="instagram.pcap",
                               capacity=128000,
                               active_timeout=120,
                               inactive_timeout=60)
my_live_streamer = Streamer(source="eth1")  # or capture from a network interface
for flow in my_capture_streamer:  # or for flow in my_live_streamer
    print(flow)  # print, append to pandas Dataframe or whatever you want :)!
{"ip_src": "192.168.122.121",
 "src_port": 43277,
 "ip_dst": "186.102.189.33",
 "dst_port": 443,
 "ip_protocol": 6,
 "src_to_dst_pkts": 6,
 "dst_to_src_pkts": 5,
 "src_to_dst_bytes": 1456,
 "dst_to_src_bytes": 477,
 "application_name": "TLS.Instagram",
 "category_name": "SocialNetwork",
 "start_time": 1555969081636,
 "end_time": 1555969082020,
 "export_reason": 2}
  • Didn’t find a specific flow feature? add it to Streamer as a plugin in few lines:

from nfstream.streamer import Streamer

def my_awesome_plugin(packet_information, flow):
    if packet_information.size > 666:
       flow.metrics['count_pkts_gt_666'] += 1
    return flow

streamer_awesome = Streamer(source='devil.pcap',
                            user_metrics={'count_pkts_gt_666': my_awesome_plugin})
for flow in streamer_awesome:
   # now you will see your created metric in generated flows
   print(flow.metrics['count_pkts_gt_666'])
  • More example and details are provided on the official Documentation.

Getting Started

Prerequisites

apt-get install python-dev libpcap-dev autogen

Installation

using pip

Binary installers for the latest released version are available:

pip3 install nfstream

from source

If you want to build nfstream on your local machine:

apt-get autogen
git clone https://github.com/aouinizied/nfstream.git
# move to nfstream directory and run
python3 setup.py install

Contributing

Please read Contributing for details on our code of conduct, and the process for submitting pull requests to us.

Authors

Zied Aouini (aouinizied) created nfstream and these fine people have contributed.

License

This project is licensed under the GPLv3 License - see the License file for details

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

nfstream-0.4.0.tar.gz (672.2 kB view details)

Uploaded Source

Built Distribution

nfstream-0.4.0-py2.py3-none-any.whl (683.0 kB view details)

Uploaded Python 2 Python 3

File details

Details for the file nfstream-0.4.0.tar.gz.

File metadata

  • Download URL: nfstream-0.4.0.tar.gz
  • Upload date:
  • Size: 672.2 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/2.0.0 pkginfo/1.5.0.1 requests/2.22.0 setuptools/41.4.0 requests-toolbelt/0.9.1 tqdm/4.36.1 CPython/3.6.7

File hashes

Hashes for nfstream-0.4.0.tar.gz
Algorithm Hash digest
SHA256 f47d61f6ae325373ea13c0935b55c2951df31d94ff818fe0a9e4fd7ee5e016a2
MD5 190ff5ac421567455fdee3c91483b907
BLAKE2b-256 3716b68ef6e7b92485fd52d1a0e4043a5dfe86186dbb0bf3ba1c5d95f6528b31

See more details on using hashes here.

File details

Details for the file nfstream-0.4.0-py2.py3-none-any.whl.

File metadata

  • Download URL: nfstream-0.4.0-py2.py3-none-any.whl
  • Upload date:
  • Size: 683.0 kB
  • Tags: Python 2, Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/2.0.0 pkginfo/1.5.0.1 requests/2.22.0 setuptools/41.4.0 requests-toolbelt/0.9.1 tqdm/4.36.1 CPython/3.6.7

File hashes

Hashes for nfstream-0.4.0-py2.py3-none-any.whl
Algorithm Hash digest
SHA256 26b57cd9a7b7e486d22f42b39d4f1f7cf8542cd2fa607f40c38ecf56d31b0031
MD5 f408916cf9098c994700a372cd65be40
BLAKE2b-256 b0bfa9d7bd9ddba684ffe1c965269fa3b642e5d28042f0128a1ffe37ecdb67db

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page