Code/Projects/SmartPlugDetector/src/main/java/edu/uci/iotproject/Main.java

   1 package edu.uci.iotproject;
   2
   3 import io.kaitai.struct.ByteBufferKaitaiStream;
   4 import io.kaitai.struct.KaitaiStruct;
   5 import io.kaitai.struct.KaitaiStream;
   6 import java.io.IOException;
   7 import java.util.ArrayList;
   8 import java.util.List;
   9 import java.util.HashMap;
  10 import java.util.Map;
  11
  12 /**
  13  * This is a system that reads PCAP files to compare
  14  * patterns of DNS hostnames, packet sequences, and packet
  15  * lengths with training data to determine certain events
  16  * or actions for smart home devices.
  17  *
  18  * @author Janus Varmarken
  19  * @author Rahmadi Trimananda (rtrimana@uci.edu)
  20  * @version 0.1
  21  */
  22 public class Main {
  23
  24
  25     /**
  26      * Private class properties
  27      */
  28     private Pcap pcap;
  29     private List<Pcap.Packet> listPacket;
  30     private Map<String, List<byte[]>> mapHostnamesToIPAddresses;
  31
  32     /**
  33      * Private class constants
  34      */
  35     private static final int DNS_PORT = 53;
  36
  37     /**
  38      * Constructor
  39      *
  40      * @param   file    name of the analyzed PCAP file
  41      */
  42     public Main(String file) throws IOException {
  43
  44         pcap = Pcap.fromFile(file);
  45         listPacket = pcap.packets();
  46         mapHostnamesToIPAddresses = new HashMap<String, List<byte[]>>();
  47     }
  48
  49
  50     /**
  51      * Private method that maps DNS hostnames to their
  52      * respected IP addresses. This method iterates
  53      * through the List<Pcap.Packet>, gets DNS packets,
  54      * and gets the IP addresses associated with them.
  55      */
  56     private void mapHostnamesToIPAddresses() {
  57
  58         int counter = 1;
  59         for(Pcap.Packet packet : listPacket) {
  60             System.out.print("# " + counter++);
  61             // Check the packet type
  62             if (packet._root().hdr().network() == Pcap.Linktype.ETHERNET) {
  63                 EthernetFrame ethFrame = (EthernetFrame) packet.body();
  64                 if (ethFrame.etherType() == EthernetFrame.EtherTypeEnum.IPV4) {
  65                     Ipv4Packet ip4Packet = (Ipv4Packet) ethFrame.body();
  66
  67                     System.out.print(" - Protocol: " + ip4Packet.protocol());
  68
  69                     if (ip4Packet.protocol() == Ipv4Packet.ProtocolEnum.UDP) {
  70                         // DNS is UDP port 53
  71                         UdpDatagram udpData = (UdpDatagram) ip4Packet.body();
  72                         System.out.print(" - Source Port: " + udpData.srcPort());
  73                         System.out.print(" - Dest Port: " + udpData.dstPort());
  74
  75                         // Source port 53 means this is DNS response
  76                         if (udpData.srcPort() == DNS_PORT) {
  77                             KaitaiStream dnsStream = new ByteBufferKaitaiStream(udpData.body());
  78                             DnsPacket dnsPacket = new DnsPacket(dnsStream);
  79                             ArrayList<DnsPacket.Answer> answers = dnsPacket.answers();
  80                             System.out.print(" - this DNS packet has " + answers.size() + " answers.");
  81                         }
  82                     }
  83                 }
  84             }
  85             System.out.println();
  86         }
  87     }
  88
  89     /*private String cloudIPAddress(String hostName) {
  90         if (hostName.equals("events.tplinkra.com"))
  91             return "205.251.203.26";
  92         else
  93             return null;
  94     }*/
  95
  96     // TODO move to separate class
  97     // Add parameter that is the trace to be analyzed (most like the pcap library's representation of a flow)
  98     public String findPattern(Map<String, List<Integer>> hostnameToPacketLengths, String smartPlugIp) {
  99
 100         // No difference, output "Complete match"
 101         // If difference, output <Packet no, deviation from expected> for each packet
 102         return null;
 103     }
 104
 105     public static void main(String[] args) {
 106         System.out.println("it works");
 107         //String file = "/scratch/traffic_measurements/Switches-Feb2018/wemo/wlan1/wlan1.setup.pcap";
 108         String file = "/home/rtrimana/pcap_processing/smart_home_traffic/Code/Projects/SmartPlugDetector/pcap/wlan1.local.dns.pcap";
 109
 110         try {
 111             Main main = new Main(file);
 112             main.mapHostnamesToIPAddresses();
 113
 114             /*Pcap data = Pcap.fromFile(file);
 115             List<Pcap.Packet> listPacket = data.packets();
 116             System.out.println("Number of packets: " + listPacket.size());
 117             System.out.println("===================");
 118             for(Pcap.Packet packet : listPacket) {
 119                 if (packet._root().hdr().network() == Pcap.Linktype.ETHERNET) {
 120                     EthernetFrame eFrame = (EthernetFrame) packet.body();
 121                     if (eFrame.etherType() == EthernetFrame.EtherTypeEnum.IPV4) {
 122                         Ipv4Packet ip4Packet = (Ipv4Packet) eFrame.body();
 123                         byte[] srcIp = ip4Packet.srcIpAddr();
 124                         byte[] dstIp = ip4Packet.dstIpAddr();
 125                         System.out.println("Byte length source: " + srcIp.length + " Byte length dest: " + dstIp.length);
 126                         System.out.print("Source: ");
 127                         for(int i = 0; i < srcIp.length; i++) {
 128                             System.out.print(Byte.toUnsignedInt(srcIp[i]));
 129                             if(i < srcIp.length-1)
 130                                 System.out.print(".");
 131                         }
 132                         System.out.print(" - Dest: ");
 133                         for(int i = 0; i < dstIp.length; i++) {
 134                             System.out.print(Byte.toUnsignedInt(dstIp[i]));
 135                             if(i < dstIp.length-1)
 136                                 System.out.print(".");
 137                             else
 138                                 System.out.println("\n");
 139                         }
 140                     }
 141                 }
 142             }*/
 143
 144         } catch (Exception e) {
 145             e.printStackTrace();
 146         }
 147     }
 148 }