NFStream is a flexible and lightweight network data analysis framework.
Package |
|
Build |
|
Documentation |
|
Coverage |
|
Quality |
|
Downloads |
|
Discussions |
Main Features
Performance: NFStream was designed to be fast with a small CPU and memory footprint.
Layer-7 visibility: NFStream dissection is based on nDPI (~300 applications including Tor, Messenger, WhatsApp, etc.).
Flexibility: add a flow feature in 2 lines as an NFPlugin.
Machine Learning oriented: add your trained model as an NFPlugin.
When to use it?
Dealing with a big pcap file and just want to aggregate it as network flows? NFStream make this path easier in few lines:
from nfstream import NFStreamer
my_awesome_streamer = NFStreamer(source="facebook.pcap") # or capture from a network interface (source="eth0")
for flow in my_awesome_streamer:
print(flow) # print, append to pandas Dataframe or whatever you want :)!NFFlow(
flow_id=0,
first_seen=1472393122365,
last_seen=1472393123665,
nfhash=1456034341,
version=4,
src_port=52066,
dst_port=443,
protocol=6,
vlan_id=0,
src_ip='192.168.43.18',
dst_ip='66.220.156.68',
total_packets=19,
total_bytes=5745,
duration=1300,
src2dst_packets=9,
src2dst_bytes=1345,
dst2src_packets=10,
dst2src_bytes=4400,
expiration_id=0,
master_protocol=91,
app_protocol=119,
application_name='TLS.Facebook',
category_name='SocialNetwork',
client_info='facebook.com',
server_info='*.facebook.com',
j3a_client='bfcc1a3891601edb4f137ab7ab25b840',
j3a_server='2d1eb5817ece335c24904f516ad5da12'
)Didn’t find a specific flow feature? add a plugin to**NFStream** in few lines:
from nfstream import NFPlugin
class my_awesome_plugin(NFPlugin):
def process(self, pkt, flow):
if pkt.length >= 666:
flow.my_awesome_plugin += 1
streamer_awesome = NFStreamer(source='devil.pcap', plugins=[my_awesome_plugin()])
for flow in streamer_awesome:
print(flow.my_awesome_plugin) # now you will see your dynamically created metric in generated flowsMore example and details are provided on the official Documentation.
Getting Started
Prerequisites
apt-get install libpcap-devInstallation
using pip
Binary installers for the latest released version are available:
pip3 install nfstreamfrom source
If you want to build NFStream on your local machine:
apt-get install autogen
git clone https://github.com/aouinizied/nfstream.git
cd nfstream
python3 setup.py installContributing
Please read Contributing for details on our code of conduct, and the process for submitting pull requests to us.
Ethics
NFStream is intended for network data research and forensics. Researchers and network data scientists can use these framework to build reliable datasets, train and evaluate network applied machine learning models. As with any packet monitoring tool, NFStream could potentially be misused. Do not run it on any network of which you are not the owner or the administrator.
License
This project is licensed under the GPLv3 License - see the License file for details
1 maintainer
Metadata
1 maintainer
Release files for nfstream 2.0.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Built distributions (wheels)
| File | Reset | |||
|---|---|---|---|---|
| nfstream-2.0.0-cp38-cp38-manylinux1_x86_64.whl | CPython 3.8 | CPython 3.8 | Linux glibc 2.5+ x86-64 | Details |
| nfstream-2.0.0-cp37-cp37m-manylinux1_x86_64.whl | CPython 3.7 | CPython 3.7 pymalloc | Linux glibc 2.5+ x86-64 | Details |
| nfstream-2.0.0-cp36-cp36m-manylinux1_x86_64.whl | CPython 3.6 | CPython 3.6 pymalloc | Linux glibc 2.5+ x86-64 | Details |
| nfstream-2.0.0-cp36-cp36m-macosx_10_13_x86_64.whl | CPython 3.6 | CPython 3.6 pymalloc | macOS 10.13+ x86-64 | Details |
Total release size: 2.6 MB
Release files / nfstream-2.0.0-cp38-cp38-manylinux1_x86_64.whl
| Download URL | nfstream-2.0.0-cp38-cp38-manylinux1_x86_64.whl |
|---|---|
| Size | 783.9 kB |
| Tags | CPython 3.8 Linux glibc 2.5+ x86-64 |
|
SHA-256 checksum How to use checksums |
3500806dadd33ec4de2232f91a035fcd4eef02638d7b4ac28c1ad2b4128b28c9
|
|
BLAKE2b-256 checksum How to use checksums |
5b814fd914e2f1f29de46d4c1d45508d6498d71764295ddebbfda03420a54a6e
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.1.1 pkginfo/1.5.0.1 requests/2.22.0 setuptools/42.0.1 requests-toolbelt/0.9.1 tqdm/4.39.0 CPython/3.8.0
|
Release files / nfstream-2.0.0-cp37-cp37m-manylinux1_x86_64.whl
| Download URL | nfstream-2.0.0-cp37-cp37m-manylinux1_x86_64.whl |
|---|---|
| Size | 783.9 kB |
| Tags | CPython 3.7 CPython 3.7 pymalloc Linux glibc 2.5+ x86-64 |
|
SHA-256 checksum How to use checksums |
cef19269a39064ee6f08fc72b5114a3cbd93d5a7088c553c8b9642da73c76ed9
|
|
BLAKE2b-256 checksum How to use checksums |
38a9cce1deb5e9d879e267fce9f5933253dfe661ad60ccaff9bd347c1311557f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.1.1 pkginfo/1.5.0.1 requests/2.22.0 setuptools/42.0.1 requests-toolbelt/0.9.1 tqdm/4.39.0 CPython/3.7.1
|
Release files / nfstream-2.0.0-cp36-cp36m-manylinux1_x86_64.whl
| Download URL | nfstream-2.0.0-cp36-cp36m-manylinux1_x86_64.whl |
|---|---|
| Size | 783.9 kB |
| Tags | CPython 3.6 CPython 3.6 pymalloc Linux glibc 2.5+ x86-64 |
|
SHA-256 checksum How to use checksums |
632716cb895c7edc4a8aea8bd4090584ba72b956b9cac4563d46fd44aea96c51
|
|
BLAKE2b-256 checksum How to use checksums |
9cdb273a58a828057a6740d20f070a60e9b009cae0b0983a2864003cb401c179
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.1.1 pkginfo/1.5.0.1 requests/2.22.0 setuptools/42.0.1 requests-toolbelt/0.9.1 tqdm/4.39.0 PyPy/7.1.1beta
|
Release files / nfstream-2.0.0-cp36-cp36m-macosx_10_13_x86_64.whl
| Download URL | nfstream-2.0.0-cp36-cp36m-macosx_10_13_x86_64.whl |
|---|---|
| Size | 237.8 kB |
| Tags | CPython 3.6 CPython 3.6 pymalloc macOS 10.13+ x86-64 |
|
SHA-256 checksum How to use checksums |
40faea120d333abfa8fa1f8dc47e29b38a5a3b1399b7c781f3fca744e632acef
|
|
BLAKE2b-256 checksum How to use checksums |
3eef02eb65edfaa394f59737fe376eb0c47c7ebdc68e888e87ccd5bacb52be73
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.1.1 pkginfo/1.5.0.1 requests/2.22.0 setuptools/39.2.0 requests-toolbelt/0.9.1 tqdm/4.39.0 CPython/3.6.5
|
