scapy.contrib.sebek module

Sebek: kernel module for data collection on honeypots.

class scapy.contrib.sebek.SebekHead

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.contrib.sebek.SebekHead'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (SebekHead).magic>, <Field (SebekHead).version>, <Field (SebekHead).type>, <Field (SebekHead).counter>, <Field (SebekHead).time_sec>, <Field (SebekHead).time_usec>]
mysummary()

DEV: can be overloaded to return a string that summarizes the layer. Only one mysummary() is used in a whole packet summary: the one of the upper layer, # noqa: E501 except if a mysummary() also returns (as a couple) a list of layers whose # noqa: E501 mysummary() must be called if they are present.

payload_guess = [({'version': 1}, <class 'scapy.contrib.sebek.SebekV1'>), ({'version': 2, 'type': 2}, <class 'scapy.contrib.sebek.SebekV2Sock'>), ({'version': 2}, <class 'scapy.contrib.sebek.SebekV2'>), ({'version': 3, 'type': 2}, <class 'scapy.contrib.sebek.SebekV3Sock'>), ({'version': 3}, <class 'scapy.contrib.sebek.SebekV3'>)]
class scapy.contrib.sebek.SebekV1

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.contrib.sebek.SebekV1'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (SebekV1).pid>, <Field (SebekV1).uid>, <Field (SebekV1).fd>, <Field (SebekV1).cmd>, <Field (SebekV1).data_length>, <Field (SebekV1).data>]
mysummary()

DEV: can be overloaded to return a string that summarizes the layer. Only one mysummary() is used in a whole packet summary: the one of the upper layer, # noqa: E501 except if a mysummary() also returns (as a couple) a list of layers whose # noqa: E501 mysummary() must be called if they are present.

class scapy.contrib.sebek.SebekV2

Bases: scapy.contrib.sebek.SebekV3

aliastypes = [<class 'scapy.contrib.sebek.SebekV2'>, <class 'scapy.contrib.sebek.SebekV3'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (SebekV3,SebekV2).parent_pid>, <Field (SebekV3,SebekV2).pid>, <Field (SebekV3,SebekV2).uid>, <Field (SebekV3,SebekV2).fd>, <Field (SebekV3,SebekV2).inode>, <Field (SebekV3,SebekV2).cmd>, <Field (SebekV3,SebekV2).data_length>, <Field (SebekV3,SebekV2).data>]
mysummary()

DEV: can be overloaded to return a string that summarizes the layer. Only one mysummary() is used in a whole packet summary: the one of the upper layer, # noqa: E501 except if a mysummary() also returns (as a couple) a list of layers whose # noqa: E501 mysummary() must be called if they are present.

class scapy.contrib.sebek.SebekV2Sock

Bases: scapy.contrib.sebek.SebekV3Sock

aliastypes = [<class 'scapy.contrib.sebek.SebekV2Sock'>, <class 'scapy.contrib.sebek.SebekV3Sock'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (SebekV3Sock,SebekV2Sock).parent_pid>, <Field (SebekV3Sock,SebekV2Sock).pid>, <Field (SebekV3Sock,SebekV2Sock).uid>, <Field (SebekV3Sock,SebekV2Sock).fd>, <Field (SebekV3Sock,SebekV2Sock).inode>, <Field (SebekV3Sock,SebekV2Sock).cmd>, <Field (SebekV3Sock,SebekV2Sock).data_length>, <Field (SebekV3Sock,SebekV2Sock).dip>, <Field (SebekV3Sock,SebekV2Sock).dport>, <Field (SebekV3Sock,SebekV2Sock).sip>, <Field (SebekV3Sock,SebekV2Sock).sport>, <Field (SebekV3Sock,SebekV2Sock).call>, <Field (SebekV3Sock,SebekV2Sock).proto>]
mysummary()

DEV: can be overloaded to return a string that summarizes the layer. Only one mysummary() is used in a whole packet summary: the one of the upper layer, # noqa: E501 except if a mysummary() also returns (as a couple) a list of layers whose # noqa: E501 mysummary() must be called if they are present.

class scapy.contrib.sebek.SebekV3

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.contrib.sebek.SebekV3'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (SebekV3,SebekV2).parent_pid>, <Field (SebekV3,SebekV2).pid>, <Field (SebekV3,SebekV2).uid>, <Field (SebekV3,SebekV2).fd>, <Field (SebekV3,SebekV2).inode>, <Field (SebekV3,SebekV2).cmd>, <Field (SebekV3,SebekV2).data_length>, <Field (SebekV3,SebekV2).data>]
mysummary()

DEV: can be overloaded to return a string that summarizes the layer. Only one mysummary() is used in a whole packet summary: the one of the upper layer, # noqa: E501 except if a mysummary() also returns (as a couple) a list of layers whose # noqa: E501 mysummary() must be called if they are present.

class scapy.contrib.sebek.SebekV3Sock

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.contrib.sebek.SebekV3Sock'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (SebekV3Sock,SebekV2Sock).parent_pid>, <Field (SebekV3Sock,SebekV2Sock).pid>, <Field (SebekV3Sock,SebekV2Sock).uid>, <Field (SebekV3Sock,SebekV2Sock).fd>, <Field (SebekV3Sock,SebekV2Sock).inode>, <Field (SebekV3Sock,SebekV2Sock).cmd>, <Field (SebekV3Sock,SebekV2Sock).data_length>, <Field (SebekV3Sock,SebekV2Sock).dip>, <Field (SebekV3Sock,SebekV2Sock).dport>, <Field (SebekV3Sock,SebekV2Sock).sip>, <Field (SebekV3Sock,SebekV2Sock).sport>, <Field (SebekV3Sock,SebekV2Sock).call>, <Field (SebekV3Sock,SebekV2Sock).proto>]
mysummary()

DEV: can be overloaded to return a string that summarizes the layer. Only one mysummary() is used in a whole packet summary: the one of the upper layer, # noqa: E501 except if a mysummary() also returns (as a couple) a list of layers whose # noqa: E501 mysummary() must be called if they are present.