scapy.layers.netflow module

Cisco NetFlow protocol v1, v5, v9 and v10 (IPFix)

HowTo dissect NetflowV9/10 (IPFix) packets:

# From a pcap / list of packets

Using sniff and sessions: >>> sniff(offline=open(“my_great_pcap.pcap”, “rb”), session=NetflowSession)

Using the netflowv9_defragment/ipfix_defragment commands: - get a list of packets containing NetflowV9/10 packets - call netflowv9_defragment(plist) to defragment the list

(ipfix_defragment is an alias for netflowv9_defragment)

# Live / on-the-flow / other: use NetflowSession >>> sniff(session=NetflowSession, prn=[…])

class scapy.layers.netflow.N9SecondsIntField(name, default, *args, **kargs)

Bases: scapy.fields.SecondsIntField, scapy.layers.netflow._AdjustableNetflowField

Defines dateTimeSeconds (without EPOCH: just seconds)

class scapy.layers.netflow.N9UTCTimeField(name, default, *args, **kargs)

Bases: scapy.fields.UTCTimeField, scapy.layers.netflow._AdjustableNetflowField

Defines dateTimeSeconds (EPOCH)

class scapy.layers.netflow.NetflowDataflowsetV9

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.netflow.NetflowDataflowsetV9'>, <class 'scapy.packet.Packet'>]
classmethod dispatch_hook(_pkt=None, *args, **kargs)
fields_desc = [<Field (NetflowDataflowsetV9).templateID>, <Field (NetflowDataflowsetV9).length>, <scapy.fields.PadField object>]
payload_guess = [({}, <class 'scapy.layers.netflow.NetflowDataflowsetV9'>)]
class scapy.layers.netflow.NetflowFlowsetV9

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.netflow.NetflowFlowsetV9'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (NetflowFlowsetV9).flowSetID>, <Field (NetflowFlowsetV9).length>, <Field (NetflowFlowsetV9).templates>]
payload_guess = [({}, <class 'scapy.layers.netflow.NetflowDataflowsetV9'>)]
class scapy.layers.netflow.NetflowHeader

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.netflow.NetflowHeader'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (NetflowHeader).version>]
payload_guess = [({'version': 1}, <class 'scapy.layers.netflow.NetflowHeaderV1'>), ({'version': 5}, <class 'scapy.layers.netflow.NetflowHeaderV5'>), ({'version': 9}, <class 'scapy.layers.netflow.NetflowHeaderV9'>), ({'version': 10}, <class 'scapy.layers.netflow.NetflowHeaderV10'>)]
class scapy.layers.netflow.NetflowHeaderV1

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.netflow.NetflowHeaderV1'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (NetflowHeaderV1).count>, <Field (NetflowHeaderV1).sysUptime>, <Field (NetflowHeaderV1).unixSecs>, <Field (NetflowHeaderV1).unixNanoSeconds>]
payload_guess = [({}, <class 'scapy.layers.netflow.NetflowRecordV1'>)]
class scapy.layers.netflow.NetflowHeaderV10

Bases: scapy.packet.Packet

IPFix (Netflow V10) Header

aliastypes = [<class 'scapy.layers.netflow.NetflowHeaderV10'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (NetflowHeaderV10).length>, <Field (NetflowHeaderV10).ExportTime>, <Field (NetflowHeaderV10).flowSequence>, <Field (NetflowHeaderV10).ObservationDomainID>]
payload_guess = [({}, <class 'scapy.layers.netflow.NetflowDataflowsetV9'>)]
class scapy.layers.netflow.NetflowHeaderV5

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.netflow.NetflowHeaderV5'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (NetflowHeaderV5).count>, <Field (NetflowHeaderV5).sysUptime>, <Field (NetflowHeaderV5).unixSecs>, <Field (NetflowHeaderV5).unixNanoSeconds>, <Field (NetflowHeaderV5).flowSequence>, <Field (NetflowHeaderV5).engineType>, <Field (NetflowHeaderV5).engineID>, <Field (NetflowHeaderV5).samplingInterval>]
payload_guess = [({}, <class 'scapy.layers.netflow.NetflowRecordV5'>)]
class scapy.layers.netflow.NetflowHeaderV9

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.netflow.NetflowHeaderV9'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (NetflowHeaderV9).count>, <Field (NetflowHeaderV9).sysUptime>, <Field (NetflowHeaderV9).unixSecs>, <Field (NetflowHeaderV9).packageSequence>, <Field (NetflowHeaderV9).SourceID>]
payload_guess = [({}, <class 'scapy.layers.netflow.NetflowDataflowsetV9'>)]
post_build(pkt, pay)

DEV: called right after the current layer is build.

Parameters:
  • pkt (str) – the current packet (build by self_buil function)
  • pay (str) – the packet payload (build by do_build_payload function)
Returns:

a string of the packet with the payload

class scapy.layers.netflow.NetflowOptionsFlowset10

Bases: scapy.layers.netflow.NetflowOptionsFlowsetV9

Netflow V10 (IPFix) Options Template FlowSet

aliastypes = [<class 'scapy.layers.netflow.NetflowOptionsFlowset10'>, <class 'scapy.layers.netflow.NetflowOptionsFlowsetV9'>, <class 'scapy.packet.Packet'>]
extract_padding(s)

DEV: to be overloaded to extract current layer’s padding.

Parameters:s (str) – the current layer
Returns:a couple of strings (actual layer, padding)
fields_desc = [<Field (NetflowOptionsFlowset10).flowSetID>, <Field (NetflowOptionsFlowset10).length>, <Field (NetflowOptionsFlowset10).templateID>, <Field (NetflowOptionsFlowset10).field_count>, <Field (NetflowOptionsFlowset10).scope_field_count>, <Field (NetflowOptionsFlowset10).scopes>, <Field (NetflowOptionsFlowset10).options>]
class scapy.layers.netflow.NetflowOptionsFlowsetOptionV9

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.netflow.NetflowOptionsFlowsetOptionV9'>, <class 'scapy.packet.Packet'>]
default_payload_class(p)

DEV: Returns the default payload class if nothing has been found by the guess_payload_class() method.

Parameters:payload (str) – the layer’s payload
Returns:the default payload class define inside the configuration file
fields_desc = [<Field (NetflowOptionsFlowsetOptionV9).optionFieldType>, <Field (NetflowOptionsFlowsetOptionV9).optionFieldlength>]
class scapy.layers.netflow.NetflowOptionsFlowsetScopeV9

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.netflow.NetflowOptionsFlowsetScopeV9'>, <class 'scapy.packet.Packet'>]
default_payload_class(p)

DEV: Returns the default payload class if nothing has been found by the guess_payload_class() method.

Parameters:payload (str) – the layer’s payload
Returns:the default payload class define inside the configuration file
fields_desc = [<Field (NetflowOptionsFlowsetScopeV9).scopeFieldType>, <Field (NetflowOptionsFlowsetScopeV9).scopeFieldlength>]
class scapy.layers.netflow.NetflowOptionsFlowsetV9

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.netflow.NetflowOptionsFlowsetV9'>, <class 'scapy.packet.Packet'>]
default_payload_class(p)

DEV: Returns the default payload class if nothing has been found by the guess_payload_class() method.

Parameters:payload (str) – the layer’s payload
Returns:the default payload class define inside the configuration file
extract_padding(s)

DEV: to be overloaded to extract current layer’s padding.

Parameters:s (str) – the current layer
Returns:a couple of strings (actual layer, padding)
fields_desc = [<Field (NetflowOptionsFlowsetV9).flowSetID>, <Field (NetflowOptionsFlowsetV9).length>, <Field (NetflowOptionsFlowsetV9).templateID>, <Field (NetflowOptionsFlowsetV9).option_scope_length>, <Field (NetflowOptionsFlowsetV9).option_field_length>, <Field (NetflowOptionsFlowsetV9).scopes>, <Field (NetflowOptionsFlowsetV9).options>]
payload_guess = [({}, <class 'scapy.layers.netflow.NetflowDataflowsetV9'>)]
post_build(pkt, pay)

DEV: called right after the current layer is build.

Parameters:
  • pkt (str) – the current packet (build by self_buil function)
  • pay (str) – the packet payload (build by do_build_payload function)
Returns:

a string of the packet with the payload

class scapy.layers.netflow.NetflowOptionsRecordOptionV9

Bases: scapy.layers.netflow.NetflowRecordV9

aliastypes = [<class 'scapy.layers.netflow.NetflowOptionsRecordOptionV9'>, <class 'scapy.layers.netflow.NetflowRecordV9'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (NetflowRecordV9,NetflowOptionsRecordScopeV9,NetflowOptionsRecordOptionV9).fieldValue>]
class scapy.layers.netflow.NetflowOptionsRecordScopeV9

Bases: scapy.layers.netflow.NetflowRecordV9

aliastypes = [<class 'scapy.layers.netflow.NetflowOptionsRecordScopeV9'>, <class 'scapy.layers.netflow.NetflowRecordV9'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (NetflowRecordV9,NetflowOptionsRecordScopeV9,NetflowOptionsRecordOptionV9).fieldValue>]
class scapy.layers.netflow.NetflowRecordV1

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.netflow.NetflowRecordV1'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (NetflowRecordV1).ipsrc>, <Field (NetflowRecordV1).ipdst>, <Field (NetflowRecordV1).nexthop>, <Field (NetflowRecordV1).inputIfIndex>, <Field (NetflowRecordV1).outpuIfIndex>, <Field (NetflowRecordV1).dpkts>, <Field (NetflowRecordV1).dbytes>, <Field (NetflowRecordV1).starttime>, <Field (NetflowRecordV1).endtime>, <Field (NetflowRecordV1).srcport>, <Field (NetflowRecordV1).dstport>, <Field (NetflowRecordV1).padding>, <Field (NetflowRecordV1).proto>, <Field (NetflowRecordV1).tos>, <Field (NetflowRecordV1).padding1>, <Field (NetflowRecordV1).padding2>]
payload_guess = [({}, <class 'scapy.layers.netflow.NetflowRecordV1'>)]
class scapy.layers.netflow.NetflowRecordV5

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.netflow.NetflowRecordV5'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (NetflowRecordV5).src>, <Field (NetflowRecordV5).dst>, <Field (NetflowRecordV5).nexthop>, <Field (NetflowRecordV5).input>, <Field (NetflowRecordV5).output>, <Field (NetflowRecordV5).dpkts>, <Field (NetflowRecordV5).dOctets>, <Field (NetflowRecordV5).first>, <Field (NetflowRecordV5).last>, <Field (NetflowRecordV5).srcport>, <Field (NetflowRecordV5).dstport>, <Field (NetflowRecordV5).pad1>, <Field (NetflowRecordV5).tcpFlags>, <Field (NetflowRecordV5).prot>, <Field (NetflowRecordV5).tos>, <Field (NetflowRecordV5).src_as>, <Field (NetflowRecordV5).dst_as>, <Field (NetflowRecordV5).src_mask>, <Field (NetflowRecordV5).dst_mask>, <Field (NetflowRecordV5).pad2>]
payload_guess = [({}, <class 'scapy.layers.netflow.NetflowRecordV5'>)]
class scapy.layers.netflow.NetflowRecordV9

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.netflow.NetflowRecordV9'>, <class 'scapy.packet.Packet'>]
default_payload_class(p)

DEV: Returns the default payload class if nothing has been found by the guess_payload_class() method.

Parameters:payload (str) – the layer’s payload
Returns:the default payload class define inside the configuration file
fields_desc = [<Field (NetflowRecordV9,NetflowOptionsRecordScopeV9,NetflowOptionsRecordOptionV9).fieldValue>]
class scapy.layers.netflow.NetflowSession(*args)

Bases: scapy.sessions.IPSession

Session used to defragment NetflowV9/10 packets on the flow. See help(scapy.layers.netflow) for more infos.

on_packet_received(pkt)

DEV: entry point. Will be called by sniff() for each received packet (that passes the filters).

class scapy.layers.netflow.NetflowTemplateFieldV9(*args, **kwargs)

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.netflow.NetflowTemplateFieldV9'>, <class 'scapy.packet.Packet'>]
default_payload_class(p)

DEV: Returns the default payload class if nothing has been found by the guess_payload_class() method.

Parameters:payload (str) – the layer’s payload
Returns:the default payload class define inside the configuration file
fields_desc = [<Field (NetflowTemplateFieldV9).fieldType>, <Field (NetflowTemplateFieldV9).fieldLength>]
class scapy.layers.netflow.NetflowTemplateV9

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.netflow.NetflowTemplateV9'>, <class 'scapy.packet.Packet'>]
default_payload_class(p)

DEV: Returns the default payload class if nothing has been found by the guess_payload_class() method.

Parameters:payload (str) – the layer’s payload
Returns:the default payload class define inside the configuration file
fields_desc = [<Field (NetflowTemplateV9).templateID>, <Field (NetflowTemplateV9).fieldCount>, <Field (NetflowTemplateV9).template_fields>]
class scapy.layers.netflow.ShortOrInt(name, default)

Bases: scapy.fields.IntField

getfield(pkt, x)

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

scapy.layers.netflow.ipfix_defragment(*args, **kwargs)

Alias for netflowv9_defragment

scapy.layers.netflow.netflowv9_defragment(plist, verb=1)

Process all NetflowV9/10 Packets to match IDs of the DataFlowsets with the Headers

params:
  • plist: the list of mixed NetflowV9/10 packets.
  • verb: verbose print (0/1)