'When the host is known it is easier to identify which packets arrived
from it and which ports are the ones that can be used for reverse shell
connections.'

def _analyze_packets_with_host(self, packets):

    from scapy.all import IP
    from scapy.all import TCP
    from scapy.all import UDP
    good_ports = []
    for p in packets:
        if ((p[TCP] is not None) and (p[TCP].dport in self._tcp_ports) and (p[IP].src == self._host) and (p[TCP].flags == 2)):
            if ((p[IP].src, p[TCP].dport, 'TCP') not in good_ports):
                good_ports.append((p[IP].src, p[TCP].dport, 'TCP'))
        if ((p[UDP] is not None) and (p[UDP].dport in self._udp_ports) and (p[IP].src == self._host)):
            if ((p[IP].src, p[UDP].dport, 'UDP') not in good_ports):
                good_ports.append((p[IP].src, p[UDP].dport, 'UDP'))
    return good_ports
