(self, username, password, pkt)
Add the username/password to the local cache.  Because
            of the way that we process packets, we use a 'purgatory' cache
            that keeps track of usernames and destination hosts temporarily.
            Once we see the password entry, we update the cache and insert
            the entry into the table.

            For example, using FTP:
                User packet comes through: ('admin', None, destination:port)
                is added to temp cache.

                User packet comes through: (None, 'passw0rd', destination:port)
                is generated and, because we have a purgatory entry with a None
                password entry and a matching destination:port, we update it,
                remove it from the temp cache, and insert it into the real table.

            This allows us to store multiple half-complete entries for the same
            protocol on a different host.  If we attempt to insert a half-complete
            entry into temp cache where one exists for destination:port, we'll
            log that entry anyways (i.e. username came twice before password) as
            it could contain important information, such as the user entering their
            password in as username, or different account names on other systems.
Add the username/password to the local cache.  Because
            of the way that we process packets, we use a 'purgatory' cache
            that keeps track of usernames and destination hosts temporarily.
            Once we see the password entry, we update the cache and insert
            the entry into the table.
Add the username / password to the local cache . Because of the way that we process packets we use a purgatory cache that keeps track of usernames and destination hosts temporarily . Once we see the password entry we update the cache and insert the entry into the table .
def add_account(self, username, password, pkt):
        """ Add the username/password to the local cache.  Because
            of the way that we process packets, we use a 'purgatory' cache
            that keeps track of usernames and destination hosts temporarily.
            Once we see the password entry, we update the cache and insert
            the entry into the table.

            For example, using FTP:
                User packet comes through: ('admin', None, destination:port)
                is added to temp cache.

                User packet comes through: (None, 'passw0rd', destination:port)
                is generated and, because we have a purgatory entry with a None
                password entry and a matching destination:port, we update it,
                remove it from the temp cache, and insert it into the real table.

            This allows us to store multiple half-complete entries for the same
            protocol on a different host.  If we attempt to insert a half-complete
            entry into temp cache where one exists for destination:port, we'll
            log that entry anyways (i.e. username came twice before password) as
            it could contain important information, such as the user entering their
            password in as username, or different account names on other systems.
        """
        host = pkt[IP].dst
        entry = [username, password, '%s:%s' % (pkt[IP].dst, pkt[TCP].dport)]
        # is this destination in purgatory?
        if host in self.purgatory.keys():
            # it is, are we kicking one out?
            if pkt[TCP].dport in self.purgatory[host].keys():
                # there's an entry here, check if the password is none
                if self.purgatory[host][pkt[TCP].dport][1] is None:
                    # update with password, log, and delete
                    self.purgatory[host][pkt[TCP].dport][1] = entry[1]
                    self.add_account_pw(tuple(self.purgatory[host][pkt[TCP].dport]), pkt)
                    del(self.purgatory[host][pkt[TCP].dport])
                else:
                    # its not, log this attempt and start over
                    self.add_account_pw(tuple(self.purgatory[host][pkt[TCP].dport]), pkt)
                    self.purgatory[host][pkt[TCP].dport] = entry
            else:
                # nope, new entry
                self.purgatory[host][pkt[TCP].dport] = entry
        else:
            # it isn't, create the entry
            self.purgatory[host] = {pkt[TCP].dport: entry}
def add_account ( self , username , password , pkt ) : host = pkt [ IP ] . dst entry = [ username , password , '%s:%s' % ( pkt [ IP ] . dst , pkt [ TCP ] . dport ) ] # is this destination in purgatory? if host in self . purgatory . keys ( ) : # it is, are we kicking one out? if pkt [ TCP ] . dport in self . purgatory [ host ] . keys ( ) : # there's an entry here, check if the password is none if self . purgatory [ host ] [ pkt [ TCP ] . dport ] [ 1 ] is None : # update with password, log, and delete self . purgatory [ host ] [ pkt [ TCP ] . dport ] [ 1 ] = entry [ 1 ] self . add_account_pw ( tuple ( self . purgatory [ host ] [ pkt [ TCP ] . dport ] ) , pkt ) del ( self . purgatory [ host ] [ pkt [ TCP ] . dport ] ) else : # its not, log this attempt and start over self . add_account_pw ( tuple ( self . purgatory [ host ] [ pkt [ TCP ] . dport ] ) , pkt ) self . purgatory [ host ] [ pkt [ TCP ] . dport ] = entry else : # nope, new entry self . purgatory [ host ] [ pkt [ TCP ] . dport ] = entry else : # it isn't, create the entry self . purgatory [ host ] = { pkt [ TCP ] . dport : entry }