PcapHelper { public static Map<String, Object> packetToFields(PacketInfo pi) { Map<String, Object> ret = new HashMap<>(); ret.put(PacketFields.PACKET_DATA.getName(), pi.getPacketBytes()); if(pi.getTcpPacket() != null) { if(pi.getTcpPacket().getSourceAddress() != null) { ret.put(org.apache.metron.common.Constants.Fields.SRC_ADDR.getName(), pi.getTcpPacket().getSourceAddress().getHostAddress()); } if(pi.getTcpPacket().getSource() != null ) { ret.put(org.apache.metron.common.Constants.Fields.SRC_PORT.getName(), pi.getTcpPacket().getSource().getPort()); } if(pi.getTcpPacket().getDestinationAddress() != null ) { ret.put(org.apache.metron.common.Constants.Fields.DST_ADDR.getName(), pi.getTcpPacket().getDestinationAddress().getHostAddress()); } if(pi.getTcpPacket().getDestination() != null ) { ret.put(org.apache.metron.common.Constants.Fields.DST_PORT.getName(), pi.getTcpPacket().getDestination().getPort()); } } if(pi.getUdpPacket() != null) { if (pi.getUdpPacket().getSource() != null) { if(pi.getUdpPacket().getSource().getAddress() != null) { ret.put(org.apache.metron.common.Constants.Fields.SRC_ADDR.getName(), pi.getUdpPacket().getSource().getAddress().getHostAddress()); } ret.put(org.apache.metron.common.Constants.Fields.SRC_PORT.getName(), pi.getUdpPacket().getSource().getPort()); } if (pi.getUdpPacket().getDestination() != null) { if(pi.getUdpPacket().getDestination().getAddress() != null ) { ret.put(org.apache.metron.common.Constants.Fields.DST_ADDR.getName(), pi.getUdpPacket().getDestination().getAddress().getHostAddress()); } ret.put(org.apache.metron.common.Constants.Fields.DST_PORT.getName(), pi.getUdpPacket().getDestination().getPort()); } } if(pi.getIpv4Packet() != null) { ret.put(org.apache.metron.common.Constants.Fields.PROTOCOL.getName(), pi.getIpv4Packet().getProtocol()); } return ret; }  static String toFilename(String topic, long timestamp, String partition, String uuid); static boolean swapBytes(org.apache.metron.spout.pcap.Endianness endianness); static byte[] getPcapGlobalHeader(Endianness endianness); static Long getTimestamp(byte[] pcap ); static Long getTimestamp(byte[] pcap, int offset, int length); static byte[] addHeaders(long tsNano, byte[] packet, Endianness endianness); static byte[] addGlobalHeader(byte[] packet, Endianness endianness); static byte[] addPacketHeader(long tsNano, byte[] packet, Endianness endianness); static Map<String, Object> packetToFields(PacketInfo pi); static List<PacketInfo> toPacketInfo(byte[] packet); static MetronEthernetDecoder createDecoder(); static List<PacketInfo> toPacketInfo(MetronEthernetDecoder decoder, byte[] pcap); static List<JSONObject> toJSON(List<PacketInfo> packetInfoList); static boolean greaterThanOrEqualTo(long a, long b); static boolean lessThanOrEqualTo(long a, long b); static final int PACKET_HEADER_SIZE; static final int GLOBAL_HEADER_SIZE; static ThreadLocal<MetronEthernetDecoder> ETHERNET_DECODER; }
@Test public void packetToFieldsShouldProperlyParserTcpPackets() throws Exception { PacketInfo packetInfo = mock(PacketInfo.class); when(packetInfo.getPacketBytes()).thenReturn("packet bytes".getBytes(StandardCharsets.UTF_8)); TcpPacket tcpPacket = mock(TcpPacket.class); InetAddress tcpSourceInetAddress = mock(InetAddress.class); when(tcpSourceInetAddress.getHostAddress()).thenReturn("tcp source address"); when(tcpPacket.getSourceAddress()).thenReturn(tcpSourceInetAddress); InetSocketAddress tcpSourceInetSocketAddress = new InetSocketAddress(22); when(tcpPacket.getSource()).thenReturn(tcpSourceInetSocketAddress); InetAddress tcpDestinationInetAddress = mock(InetAddress.class); when(tcpDestinationInetAddress.getHostAddress()).thenReturn("tcp destination address"); when(tcpPacket.getDestinationAddress()).thenReturn(tcpDestinationInetAddress); InetSocketAddress tcpDestinationInetSocketAddress = new InetSocketAddress(55791); when(tcpPacket.getDestination()).thenReturn(tcpDestinationInetSocketAddress); when(packetInfo.getTcpPacket()).thenReturn(tcpPacket); Ipv4Packet ipv4Packet = mock(Ipv4Packet.class); when(ipv4Packet.getProtocol()).thenReturn(6); when(packetInfo.getIpv4Packet()).thenReturn(ipv4Packet); Map<String, Object> actualFields = PcapHelper.packetToFields(packetInfo); assertArrayEquals("packet bytes".getBytes(StandardCharsets.UTF_8), (byte[]) actualFields.get(PcapHelper.PacketFields.PACKET_DATA.getName())); assertEquals("tcp source address", actualFields.get(Fields.SRC_ADDR.getName())); assertEquals(22, actualFields.get(Fields.SRC_PORT.getName())); assertEquals("tcp destination address", actualFields.get(Fields.DST_ADDR.getName())); assertEquals(55791, actualFields.get(Fields.DST_PORT.getName())); assertEquals(6, actualFields.get(Fields.PROTOCOL.getName())); }
@Test public void packetToFieldsShouldProperlyParserUdpPackets() throws Exception { PacketInfo packetInfo = mock(PacketInfo.class); when(packetInfo.getPacketBytes()).thenReturn("packet bytes".getBytes(StandardCharsets.UTF_8)); UdpPacket udpPacket = mock(UdpPacket.class); InetAddress udpSourceInetAddress = mock(InetAddress.class); when(udpSourceInetAddress.getHostAddress()).thenReturn("udp source address"); InetSocketAddress udpSourceInetSocketAddress = new InetSocketAddress(udpSourceInetAddress, 68); when(udpPacket.getSource()).thenReturn(udpSourceInetSocketAddress); InetAddress udpDestinationInetAddress = mock(InetAddress.class); when(udpDestinationInetAddress.getHostAddress()).thenReturn("udp destination address"); InetSocketAddress udpDestinationInetSocketAddress = new InetSocketAddress(udpDestinationInetAddress, 67); when(udpPacket.getDestination()).thenReturn(udpDestinationInetSocketAddress); when(packetInfo.getUdpPacket()).thenReturn(udpPacket); Ipv4Packet ipv4Packet = mock(Ipv4Packet.class); when(ipv4Packet.getProtocol()).thenReturn(17); when(packetInfo.getIpv4Packet()).thenReturn(ipv4Packet); Map<String, Object> actualFields = PcapHelper.packetToFields(packetInfo); assertArrayEquals("packet bytes".getBytes(StandardCharsets.UTF_8), (byte[]) actualFields.get(PcapHelper.PacketFields.PACKET_DATA.getName())); assertEquals("udp source address", actualFields.get(Fields.SRC_ADDR.getName())); assertEquals(68, actualFields.get(Fields.SRC_PORT.getName())); assertEquals("udp destination address", actualFields.get(Fields.DST_ADDR.getName())); assertEquals(67, actualFields.get(Fields.DST_PORT.getName())); assertEquals(17, actualFields.get(Fields.PROTOCOL.getName())); }