fdutils/net.py
def check_tcp_3way_handshake_established(pcap_file, src, dst):
    """ Using libpcap filter the pcap file using the BPF filter for tcp-syn, tcp-syn-ack and tcp-ack and no fin or rst
    We are going to check 3way handshake is executed
    """
    from pcap import pcap
    import dpkt
    pc = pcap(pcap_file)
    # set BPF filter for these two hosts and tcp flags of interest
    pc.setfilter('tcp[tcpflags]&(tcp-syn|tcp-ack|tcp-fin|tcp-rst)>1 and host {0} and host {1}'.format(src, dst))
    syn_sent = syn_ack_sent = False
    src_port = dst_port = first_syn = prev_seq = 0
    for ts, pkt in pc:
        eth = dpkt.ethernet.Ethernet(pkt)
        ip = eth.data
        tcp = ip.data

        # look for the first syn from src
        if not tcp.flags & (dpkt.tcp.TH_ACK | dpkt.tcp.TH_SYN):
            continue

        # convert to string
        ip_src = socket.inet_ntoa(ip.src)
        ip_dst = socket.inet_ntoa(ip.dst)
        ack = tcp.ack
        seq = tcp.seq
        if tcp.flags & dpkt.tcp.TH_SYN and ip_src == src:
            syn_sent = True
            syn_ack_sent = False
            src_port = tcp.sport
            dst_port = tcp.dport
            first_syn = ts
            prev_seq = seq
            log.info("Syn found...at " + str(ts))

        elif (tcp.flags & (dpkt.tcp.TH_SYN | dpkt.tcp.TH_ACK) and ip_dst == src and ip_src == dst and syn_sent and
              ack == (prev_seq + 1) and src_port == tcp.dport and dst_port == tcp.sport):

            syn_ack_sent = True
            prev_seq = seq
            log.info("Syn-Ack found...at " + str(ts))

        elif (tcp.flags & dpkt.tcp.TH_ACK and ip_src == src and ip_dst == dst and syn_ack_sent and
              ack == (prev_seq + 1) and src_port == tcp.sport and dst_port == tcp.dport):

            # connection established

            return True, first_syn
        elif src_port in (tcp.sport, tcp.dport) or dst_port in (tcp.sport, tcp.dport):  # tcp fin or rst for tcp connection sent before connection established
            syn_sent = syn_ack_sent = False

    return False, 0
 Using libpcap filter the pcap file using the BPF filter for tcp-syn, tcp-syn-ack and tcp-ack and no fin or rst
    We are going to check 3way handshake is executed
    
Using libpcap filter the pcap file using the BPF filter for tcp-syn, tcp-syn-ack and tcp-ack and no fin or rst
We are going to check 3way handshake is executed
Using libpcap filter the pcap file using the BPF filter for tcp - syn tcp - syn - ack and tcp - ack and no fin or rst We are going to check 3way handshake is executed
def check_tcp_3way_handshake_established(pcap_file, src, dst):
    from pcap import pcap
    import dpkt
    pc = pcap(pcap_file)
    pc.setfilter('tcp[tcpflags]&(tcp-syn|tcp-ack|tcp-fin|tcp-rst)>1 and host {0} and host {1}'.format(src, dst))
    syn_sent = syn_ack_sent = False
    src_port = dst_port = first_syn = prev_seq = 0
    for ts, pkt in pc:
        eth = dpkt.ethernet.Ethernet(pkt)
        ip = eth.data
        tcp = ip.data
        if not tcp.flags & (dpkt.tcp.TH_ACK | dpkt.tcp.TH_SYN):
            continue
        ip_src = socket.inet_ntoa(ip.src)
        ip_dst = socket.inet_ntoa(ip.dst)
        ack = tcp.ack
        seq = tcp.seq
        if tcp.flags & dpkt.tcp.TH_SYN and ip_src == src:
            syn_sent = True
            syn_ack_sent = False
            src_port = tcp.sport
            dst_port = tcp.dport
            first_syn = ts
            prev_seq = seq
            log.info("Syn found...at " + str(ts))
        elif (tcp.flags & (dpkt.tcp.TH_SYN | dpkt.tcp.TH_ACK) and ip_dst == src and ip_src == dst and syn_sent and
              ack == (prev_seq + 1) and src_port == tcp.dport and dst_port == tcp.sport):
            syn_ack_sent = True
            prev_seq = seq
            log.info("Syn-Ack found...at " + str(ts))
        elif (tcp.flags & dpkt.tcp.TH_ACK and ip_src == src and ip_dst == dst and syn_ack_sent and
              ack == (prev_seq + 1) and src_port == tcp.sport and dst_port == tcp.dport):
            return True, first_syn
        elif src_port in (tcp.sport, tcp.dport) or dst_port in (tcp.sport, tcp.dport):  
            syn_sent = syn_ack_sent = False
    return False, 0
def check_tcp_3way_handshake_established ( pcap_file , src , dst ) : from pcap import pcap import dpkt pc = pcap ( pcap_file ) pc . setfilter ( 'tcp[tcpflags]&(tcp-syn|tcp-ack|tcp-fin|tcp-rst)>1 and host {0} and host {1}' . format ( src , dst ) ) syn_sent = syn_ack_sent = False src_port = dst_port = first_syn = prev_seq = 0 for ts , pkt in pc : eth = dpkt . ethernet . Ethernet ( pkt ) ip = eth . data tcp = ip . data if not tcp . flags & ( dpkt . tcp . TH_ACK | dpkt . tcp . TH_SYN ) : continue ip_src = socket . inet_ntoa ( ip . src ) ip_dst = socket . inet_ntoa ( ip . dst ) ack = tcp . ack seq = tcp . seq if tcp . flags & dpkt . tcp . TH_SYN and ip_src == src : syn_sent = True syn_ack_sent = False src_port = tcp . sport dst_port = tcp . dport first_syn = ts prev_seq = seq log . info ( "Syn found...at " + str ( ts ) ) elif ( tcp . flags & ( dpkt . tcp . TH_SYN | dpkt . tcp . TH_ACK ) and ip_dst == src and ip_src == dst and syn_sent and ack == ( prev_seq + 1 ) and src_port == tcp . dport and dst_port == tcp . sport ) : syn_ack_sent = True prev_seq = seq log . info ( "Syn-Ack found...at " + str ( ts ) ) elif ( tcp . flags & dpkt . tcp . TH_ACK and ip_src == src and ip_dst == dst and syn_ack_sent and ack == ( prev_seq + 1 ) and src_port == tcp . sport and dst_port == tcp . dport ) : return True , first_syn elif src_port in ( tcp . sport , tcp . dport ) or dst_port in ( tcp . sport , tcp . dport ) : syn_sent = syn_ack_sent = False return False , 0
Using libpcap filter the pcap file using the BPF filter for tcp-syn, tcp-syn-ack and tcp-ack and no fin or rst
We are going to check 3way handshake is executed
Using libpcap filter the pcap file using the BPF filter for tcp - syn tcp - syn - ack and tcp - ack and no fin or rst We are going to check 3way handshake is executed
""" Using libpcap filter the pcap file using the BPF filter for tcp-syn, tcp-syn-ack and tcp-ack and no fin or rst
    We are going to check 3way handshake is executed
    """ # set BPF filter for these two hosts and tcp flags of interest # look for the first syn from src # convert to string # connection established # tcp fin or rst for tcp connection sent before connection established
pcap_file
src
dst