ja3.py
def main():
    """Intake arguments from the user and print out JA3 output."""
    desc = "A python script for extracting JA3 fingerprints from PCAP files"
    parser = argparse.ArgumentParser(description=(desc))
    parser.add_argument("pcap", help="The pcap file to process")
    help_text = "Look for client hellos on any port instead of just 443"
    parser.add_argument("-a", "--any_port", required=False,
                        action="store_true", default=False,
                        help=help_text)
    help_text = "Print out as JSON records for downstream parsing"
    parser.add_argument("-j", "--json", required=False, action="store_true",
                        default=True, help=help_text)
    parser.add_argument("--loopback", action="store_true",
                        default=False, help="loopback capture") 
    args = parser.parse_args()

    global LOOPBACK
    LOOPBACK = args.loopback

    # Use an iterator to process each line of the file
    output = None
    with open(args.pcap, 'rb') as fp:
        try:
            capture = dpkt.pcap.Reader(fp)
        except ValueError as e:
            raise Exception("File doesn't appear to be a PCAP: %s" % e)
        output = process_pcap(capture, any_port=args.any_port)

    if args.json:
        output = json.dumps(output, indent=4, sort_keys=True)
        print(output)
    else:
        for record in output:
            tmp = '[{dest}:{port}] JA3: {segment} --> {digest}'
            tmp = tmp.format(dest=record['destination_ip'],
                             port=record['destination_port'],
                             segment=record['ja3'],
                             digest=record['ja3_digest'])
            print(tmp)
Intake arguments from the user and print out JA3 output.
Intake arguments from the user and print out JA3 output.
Intake arguments from the user and print out JA3 output .
def main():
    desc = "A python script for extracting JA3 fingerprints from PCAP files"
    parser = argparse.ArgumentParser(description=(desc))
    parser.add_argument("pcap", help="The pcap file to process")
    help_text = "Look for client hellos on any port instead of just 443"
    parser.add_argument("-a", "--any_port", required=False,
                        action="store_true", default=False,
                        help=help_text)
    help_text = "Print out as JSON records for downstream parsing"
    parser.add_argument("-j", "--json", required=False, action="store_true",
                        default=True, help=help_text)
    parser.add_argument("--loopback", action="store_true",
                        default=False, help="loopback capture") 
    args = parser.parse_args()
    global LOOPBACK
    LOOPBACK = args.loopback
    output = None
    with open(args.pcap, 'rb') as fp:
        try:
            capture = dpkt.pcap.Reader(fp)
        except ValueError as e:
            raise Exception("File doesn't appear to be a PCAP: %s" % e)
        output = process_pcap(capture, any_port=args.any_port)
    if args.json:
        output = json.dumps(output, indent=4, sort_keys=True)
        print(output)
    else:
        for record in output:
            tmp = '[{dest}:{port}] JA3: {segment} --> {digest}'
            tmp = tmp.format(dest=record['destination_ip'],
                             port=record['destination_port'],
                             segment=record['ja3'],
                             digest=record['ja3_digest'])
            print(tmp)
def main ( ) : desc = "A python script for extracting JA3 fingerprints from PCAP files" parser = argparse . ArgumentParser ( description = ( desc ) ) parser . add_argument ( "pcap" , help = "The pcap file to process" ) help_text = "Look for client hellos on any port instead of just 443" parser . add_argument ( "-a" , "--any_port" , required = False , action = "store_true" , default = False , help = help_text ) help_text = "Print out as JSON records for downstream parsing" parser . add_argument ( "-j" , "--json" , required = False , action = "store_true" , default = True , help = help_text ) parser . add_argument ( "--loopback" , action = "store_true" , default = False , help = "loopback capture" ) args = parser . parse_args ( ) global LOOPBACK LOOPBACK = args . loopback output = None with open ( args . pcap , 'rb' ) as fp : try : capture = dpkt . pcap . Reader ( fp ) except ValueError as e : raise Exception ( "File doesn't appear to be a PCAP: %s" % e ) output = process_pcap ( capture , any_port = args . any_port ) if args . json : output = json . dumps ( output , indent = 4 , sort_keys = True ) print ( output ) else : for record in output : tmp = '[{dest}:{port}] JA3: {segment} --> {digest}' tmp = tmp . format ( dest = record [ 'destination_ip' ] , port = record [ 'destination_port' ] , segment = record [ 'ja3' ] , digest = record [ 'ja3_digest' ] ) print ( tmp )
Intake arguments from the user and print out JA3 output.
Intake arguments from the user and print out JA3 output .
"""Intake arguments from the user and print out JA3 output.""" # Use an iterator to process each line of the file