#!/usr/bin/python #coding=utf-8 import dpkt import socket import optparse# 默認設置檢測不正常數據包的數量的閾值為1000 THRESH = 1000def findDownload(pcap):for (ts, buf) in pcap:try:eth = dpkt.ethernet.Ethernet(buf)ip = eth.datasrc = socket.inet_ntoa(ip.src)# 獲取TCP數據tcp = ip.data# 解析TCP中的上層協議HTTP的請求http = dpkt.http.Request(tcp.data)# 若是GET方法，且請求行中包含“.zip”和“loic”字樣則判斷為下載LOICif http.method == 'GET':uri = http.uri.lower()if '.zip' in uri and 'loic' in uri:print "[!] " + src + " Downloaded LOIC."except:passdef findHivemind(pcap):for (ts, buf) in pcap:try:eth = dpkt.ethernet.Ethernet(buf)ip = eth.datasrc = socket.inet_ntoa(ip.src)dst = socket.inet_ntoa(ip.dst)tcp = ip.datadport = tcp.dportsport = tcp.sport# 若目標端口為6667且含有“!lazor”指令，則確定是某個成員提交一個攻擊指令if dport == 6667:if '!lazor' in tcp.data.lower():print '[!] DDoS Hivemind issued by: '+srcprint '[+] Target CMD: ' + tcp.data# 若源端口為6667且含有“!lazor”指令，則確定是服務器在向HIVE中的成員發布攻擊的消息if sport == 6667:if '!lazor' in tcp.data.lower():print '[!] DDoS Hivemind issued to: '+srcprint '[+] Target CMD: ' + tcp.dataexcept:passdef findAttack(pcap):pktCount = {}for (ts, buf) in pcap:try:eth = dpkt.ethernet.Ethernet(buf)ip = eth.datasrc = socket.inet_ntoa(ip.src)dst = socket.inet_ntoa(ip.dst)tcp = ip.datadport = tcp.dport# 累計各個src地址對目標地址80端口訪問的次數if dport == 80:stream = src + ':' + dstif pktCount.has_key(stream):pktCount[stream] = pktCount[stream] + 1else:pktCount[stream] = 1except:passfor stream in pktCount:pktsSent = pktCount[stream]# 若超過設置檢測的閾值，則判斷為進行DDoS攻擊if pktsSent > THRESH:src = stream.split(':')[0]dst = stream.split(':')[1]print '[+] ' + src + ' attacked ' + dst + ' with ' + str(pktsSent) + ' pkts.'def main():parser = optparse.OptionParser("[*]Usage python findDDoS.py -p <pcap file> -t <thresh>")parser.add_option('-p', dest='pcapFile', type='string', help='specify pcap filename')parser.add_option('-t', dest='thresh', type='int', help='specify threshold count ')(options, args) = parser.parse_args()if options.pcapFile == None:print parser.usageexit(0)if options.thresh != None:THRESH = options.threshpcapFile = options.pcapFile# 這里的pcap文件解析只能調用一次，注釋掉另行修改# f = open(pcapFile)# pcap = dpkt.pcap.Reader(f)# findDownload(pcap)# findHivemind(pcap)# findAttack(pcap)with open(pcapFile, 'r') as f:pcap = dpkt.pcap.Reader(f)findDownload(pcap)with open(pcapFile, 'r') as f:pcap = dpkt.pcap.Reader(f)findHivemind(pcap)with open(pcapFile, 'r') as f:pcap = dpkt.pcap.Reader(f)findAttack(pcap)if __name__ == '__main__':main()

總結

以上是生活随笔為你收集整理的分析LOIC流，判断DDoS攻击源的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。