DEVLOG 002 - Finished the parser

Second devlog the title says it all i finished the parser that is section 1 complete!

-REFERENCES-
https://medium.com/a-bit-off/scapy-ways-of-reading-pcaps-1367a05e98a8 Great article about different ways you can read pcap files

https://tcpreplay.appneta.com/wiki/captures.html this is where i got the pcap file

THE IDEA

Now time for the parser ,i used scapy because its a widely used library for manipulating packets and also has great documentation. The end goal would be to create a conversations object in which each isolated conversation of various machines would be stored so that the animator can easily move through the data without having to do any extra work per frame.

-IMPLEMENTATION-

Implementation was relatively straightforward. I iterate through the packets returned by rdpcap(), create an empty conversation object, and insert each packet into its corresponding conversation. If a matching conversation already exists, the packet is appended. Otherwise, a new conversation is created. at the end the conversations dict will be looking something like this

conversations = {convo1: [{ time:12, ip:12.32.45 ..etc},{ time:13, ip:12.32.45 ..etc}], convo2: ….}

Struggles

I first planned to use a hashmap keyed by timestamps, but duplicate timestamps and decimal precision quickly made that idea messy. Instead, I grouped packets into conversations and let the animator iterate through them chronologically like a playhead. It keeps the parser simple and makes the animation side much easier. Making everything asynchronous is Future Me’s problem. Anyways, here’s the code…