1 package edu.uci.iotproject;
3 import edu.uci.iotproject.analysis.PcapPacketPair;
4 import edu.uci.iotproject.analysis.PcapProcessingPipeline;
5 import edu.uci.iotproject.analysis.TcpConversationUtils;
6 import org.pcap4j.core.*;
8 import java.io.EOFException;
9 import java.net.UnknownHostException;
10 import java.util.ArrayList;
11 import java.util.List;
12 import java.util.concurrent.TimeoutException;
15 * This is a system that reads PCAP files to compare
16 * patterns of DNS hostnames, packet sequences, and packet
17 * lengths with training data to determine certain events
18 * or actions for smart home devices.
20 * @author Janus Varmarken
21 * @author Rahmadi Trimananda (rtrimana@uci.edu)
27 public static void main(String[] args) throws PcapNativeException, NotOpenException, EOFException, TimeoutException, UnknownHostException {
28 // -------------------------------------------------------------------------------------------------------------
29 // Example/debug code for searching for a pattern at the MAC layer.
30 // String fileName = "./pcap/mac-tplink.local.pcapng";
33 // handle = Pcaps.openOffline(fileName, PcapHandle.TimestampPrecision.NANO);
34 // } catch (PcapNativeException pne) {
35 // handle = Pcaps.openOffline(fileName);
37 // Arrays.asList(1590, 1590, 1590, 1001, 337, 197, 636, 1311, 177) // Full pattern (all non-zero payload packets).
38 // MacLayerFlowPattern pattern = new MacLayerFlowPattern("TP_LINK_LOCAL_OFF_MAC", "50:c7:bf:33:1f:09", Arrays.asList(637, 1312));
39 // MacLayerFlowPatternFinder finder = new MacLayerFlowPatternFinder(handle, pattern);
40 // finder.findFlowPattern();
41 // -------------------------------------------------------------------------------------------------------------
43 // //final String fileName = args.length > 0 ? args[0] : "/home/rtrimana/pcap_processing/smart_home_traffic/Code/Projects/SmartPlugDetector/pcap/wlan1.local.dns.pcap";
44 // final String fileName = args.length > 0 ? args[0] : "/scratch/June-2018/TPLink/wlan1/tplink.wlan1.local.pcap";
45 // //final String fileName = args.length > 0 ? args[0] : "/scratch/June-2018/DLink/wlan1/dlink.wlan1.local.pcap";
46 // final String trainingFileName = "./pcap/TP_LINK_LOCAL_ON_SUBSET.pcap";
47 //// final String trainingFileName = "./pcap/TP_LINK_LOCAL_ON.pcap";
49 //// // ====== Debug code ======
51 // PcapHandle trainingPcap;
53 // handle = Pcaps.openOffline(fileName, PcapHandle.TimestampPrecision.NANO);
54 // trainingPcap = Pcaps.openOffline(trainingFileName, PcapHandle.TimestampPrecision.NANO);
55 // } catch (PcapNativeException pne) {
56 // handle = Pcaps.openOffline(fileName);
57 // trainingPcap = Pcaps.openOffline(trainingFileName);
60 //// // TODO: The followings are the way to extract multiple hostnames and their associated packet lengths lists
61 //// //List<String> list = new ArrayList<>();
62 //// //list.add("events.tplinkra.com");
63 //// //FlowPattern fp = new FlowPattern("TP_LINK_LOCAL_ON", list, trainingPcap);
64 //// //List<String> list2 = new ArrayList<>();
65 //// //list2.add("devs.tplinkcloud.com");
66 //// //list2.add("events.tplinkra.com");
67 //// //FlowPattern fp3 = new FlowPattern("TP_LINK_REMOTE_ON", list2, trainingPcap);
69 // FlowPattern fp = new FlowPattern("TP_LINK_LOCAL_ON", "events.tplinkra.com", trainingPcap);
70 // //FlowPattern fp = new FlowPattern("DLINK_LOCAL_ON", "rfe-us-west-1.dch.dlink.com", trainingPcap);
71 // FlowPatternFinder fpf = new FlowPatternFinder(handle, fp);
74 //// // ========================
77 PcapReader pcapReader = new PcapReader(args[0]);
78 PcapProcessingPipeline pipeline = new PcapProcessingPipeline(pcapReader);
79 TcpReassembler tcpReassembler = new TcpReassembler();
80 pipeline.addPcapPacketConsumer(tcpReassembler);
81 pipeline.executePipeline();
82 System.out.println("Pipeline terminated");
84 List<List<PcapPacketPair>> pairs = new ArrayList<>();
85 for (Conversation c : tcpReassembler.getTcpConversations()) {
86 pairs.add(TcpConversationUtils.extractPacketPairs(c));
90 // -------- 07-17-2018 --------
91 // Only consider packets to/from the TP-Link plug.
92 PcapReader pcapReader = new PcapReader(args[0], "ip host 192.168.1.159");
93 TcpReassembler tcpReassembler = new TcpReassembler();
95 while((packet = pcapReader.readNextPacket()) != null) {
96 tcpReassembler.consumePacket(packet);
98 // Now we have a set of reassembled TCP conversations.
99 List<Conversation> conversations = tcpReassembler.getTcpConversations();
100 for(Conversation c : conversations) {
101 List<PcapPacketPair> pairs = TcpConversationUtils.extractPacketPairs(c);
102 for (PcapPacketPair pair : pairs) {
104 // 1. discard packets that are not within X seconds after trigger time
105 // 2. conversations may be (are) with different servers - so need to plot in different plots, one per hostname?
109 // ----------------------------
120 // TP-Link MAC 50:c7:bf:33:1f:09 and usually IP 192.168.1.159 (remember to verify per file)