Update pipeline: graph now maps IoT devices' MACs to hostnames or other MACs (if...

[pingpong.git] / extract_from_tshark.py

diff --git a/extract_from_tshark.py b/extract_from_tshark.py
index 7c1270fda73c82dc19aa4aeec704c532255cfa3d..5704a975bbf891678e75533a2d435b52a597969d 100644 (file)
--- a/extract_from_tshark.py
+++ b/extract_from_tshark.py
@@ -36,6 +36,11 @@ json_key_frame_comment = json_key_frame + ".comment"
 json_key_frame_ts = json_key_frame + ".time_epoch"\r
 \r
 \r
+JSON_KEY_ETH = "eth"\r
+JSON_KEY_ETH_SRC = "eth.src"\r
+JSON_KEY_ETH_DST = "eth.dst"\r
+\r
+\r
 def make_unique(key, dct):\r
     counter = 0\r
     unique_key = key\r
@@ -103,6 +108,9 @@ def change_file(fpath):
                 # JV: Also include src so we can see what device initiates the traffic\r
                 new_packet["src_ip"] = layers[json_key_ip][json_key_ip + ".src"]\r
                 new_packet["src_port"] = int(layers[json_key_tcp][json_key_tcp + ".srcport"])\r
+                #JV: Also include eth soure/destination info so that we can map traffic to physical device using MAC\r
+                new_packet[JSON_KEY_ETH_SRC] = layers[JSON_KEY_ETH][JSON_KEY_ETH_SRC]\r
+                new_packet[JSON_KEY_ETH_DST] = layers[JSON_KEY_ETH][JSON_KEY_ETH_DST]\r
 \r
                 # Go through all HTTP fields and extract the ones that are needed\r
                 http_data = layers[json_key_http]\r