()
Intake arguments from the user and print out JA3 output.
Intake arguments from the user and print out JA3 output.
Intake arguments from the user and print out JA3 output .
def main():
    """Intake arguments from the user and print out JA3 output."""
    desc = "A python script for extracting JA3 fingerprints from PCAP files"
    parser = argparse.ArgumentParser(description=(desc))
    parser.add_argument("pcap", help="The pcap file to process")
    help_text = "Look for client hellos on any port instead of just 443"
    parser.add_argument("-a", "--any_port", required=False,
                        action="store_true", default=False,
                        help=help_text)
    help_text = "Print out as JSON records for downstream parsing"
    parser.add_argument("-j", "--json", required=False, action="store_true",
                        default=False, help=help_text)
    args = parser.parse_args()

    # Use an iterator to process each line of the file
    output = None
    with open(args.pcap, 'rb') as fp:
        try:
            capture = dpkt.pcap.Reader(fp)
        except ValueError as e_pcap:
            try:
                fp.seek(0, os.SEEK_SET)
                capture = dpkt.pcapng.Reader(fp)
            except ValueError as e_pcapng:
                raise Exception(
                        "File doesn't appear to be a PCAP or PCAPng: %s, %s" %
                        (e_pcap, e_pcapng))
        output = process_pcap(capture, any_port=args.any_port)

    if args.json:
        output = json.dumps(output, indent=4, sort_keys=True)
        print(output)
    else:
        for record in output:
            tmp = '[{dest}:{port}] JA3S: {segment} --> {digest}'
            tmp = tmp.format(dest=record['destination_ip'],
                             port=record['destination_port'],
                             segment=record['ja3'],
                             digest=record['ja3_digest'])
            print(tmp)
def main ( ) : desc = "A python script for extracting JA3 fingerprints from PCAP files" parser = argparse . ArgumentParser ( description = ( desc ) ) parser . add_argument ( "pcap" , help = "The pcap file to process" ) help_text = "Look for client hellos on any port instead of just 443" parser . add_argument ( "-a" , "--any_port" , required = False , action = "store_true" , default = False , help = help_text ) help_text = "Print out as JSON records for downstream parsing" parser . add_argument ( "-j" , "--json" , required = False , action = "store_true" , default = False , help = help_text ) args = parser . parse_args ( ) # Use an iterator to process each line of the file output = None with open ( args . pcap , 'rb' ) as fp : try : capture = dpkt . pcap . Reader ( fp ) except ValueError as e_pcap : try : fp . seek ( 0 , os . SEEK_SET ) capture = dpkt . pcapng . Reader ( fp ) except ValueError as e_pcapng : raise Exception ( "File doesn't appear to be a PCAP or PCAPng: %s, %s" % ( e_pcap , e_pcapng ) ) output = process_pcap ( capture , any_port = args . any_port ) if args . json : output = json . dumps ( output , indent = 4 , sort_keys = True ) print ( output ) else : for record in output : tmp = '[{dest}:{port}] JA3S: {segment} --> {digest}' tmp = tmp . format ( dest = record [ 'destination_ip' ] , port = record [ 'destination_port' ] , segment = record [ 'ja3' ] , digest = record [ 'ja3_digest' ] ) print ( tmp )