Skip to content

Commit c1ec31f

Browse files
nullbindnullbind
authored
Create Get-IpInfoFromCap.ps1
1 parent bbc4164 commit c1ec31f

File tree

1 file changed

+267
-0
lines changed

1 file changed

+267
-0
lines changed

‎Get-IpInfoFromCap.ps1

Lines changed: 267 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,267 @@
1+
# Author: scott sutherland
2+
# This script uses tshark to parse the src.ip, dst.ip, and dst.port from a provided .cap file. It then looks up owner information.
3+
# Add threading (its super slow)
4+
# Add udp parsing
5+
# Note: currently udp ports are not imported and show up as 0
6+
7+
# Example commands
8+
# Get-IpInfoFromCap -capPath "c:\temp\packetcapture.cap" -Verbose -IpFilter 1.1.1.1
9+
# Get-IpInfoFromCap -capPath "c:\temp\packetcapture.cap" -Verbose -IpFilter 1.1.1.1
10+
# Get-IpInfoFromCap -capPath "c:\temp\packetcapture.cap" -Verbose -IpFilter 1.1.1.1 | Out-GridView
11+
# Get-IpInfoFromCap -capPath "c:\temp\packetcapture.cap" -Verbose -IpFilter 1.1.1.1 | Export-Csv c:\temp\output.csv
12+
# Get-IpInfoFromCap -capPath "c:\temp\packetcapture.cap" -Verbose -IpFilter 1.1.1.1 -IpAPI
13+
14+
Function Get-IpInfoFromCap{
15+
16+
[CmdletBinding()]
17+
param
18+
(
19+
[Parameter(Mandatory=$True, ValueFromPipeline = $true, HelpMessage="Cap file path.")]
20+
[string]$capPath,
21+
[string]$IpFilter,
22+
[int]$Port,
23+
[string]$TsharkPath,
24+
[switch]$IpAPI
25+
)
26+
27+
Begin
28+
{
29+
# Set tshark path
30+
if( -not $TsharkPath){
31+
$TsharkPath = 'C:\Program Files\Wireshark\tshark.exe'
32+
}
33+
34+
# Verify tshark path
35+
If ((Test-Path $TsharkPath) -eq $True) {
36+
Write-Verbose "The tshark path is valid: $TsharkPath"
37+
}else{
38+
Write-Host "The tshark path is invalid: $TsharkPath"
39+
return
40+
}
41+
42+
# Port table
43+
$TblPortInfo = New-Object System.Data.DataTable
44+
$TblPortInfo.Columns.Add("SrcIp") | Out-Null
45+
$TblPortInfo.Columns.Add("DstIp") | Out-Null
46+
$TblPortInfo.Columns.Add("Ports") | Out-Null
47+
48+
# IP info table
49+
$TblIPInfo = new-object System.Data.DataTable
50+
$TblIPInfo.Columns.Add("IpDest") | Out-Null
51+
$TblIPInfo.Columns.Add("IpSrc") | Out-Null
52+
$TblIPInfo.Columns.Add("Owner") | Out-Null
53+
$TblIPInfo.Columns.Add("ArinRef") | Out-Null
54+
$TblIPInfo.Columns.Add("StartRange") | Out-Null
55+
$TblIPInfo.Columns.Add("EndRange") | Out-Null
56+
$TblIPInfo.Columns.Add("Country") | Out-Null
57+
$TblIPInfo.Columns.Add("City") | Out-Null
58+
$TblIPInfo.Columns.Add("Zip") | Out-Null
59+
$TblIPInfo.Columns.Add("ISP") | Out-Null
60+
61+
# Output table
62+
$OutputTbl = new-object System.Data.DataTable
63+
$OutputTbl.Columns.Add("IpSrc") | Out-Null
64+
$OutputTbl.Columns.Add("IpDest") | Out-Null
65+
$OutputTbl.Columns.Add("Owner") | Out-Null
66+
$OutputTbl.Columns.Add("ArinRef") | Out-Null
67+
$OutputTbl.Columns.Add("StartRange") | Out-Null
68+
$OutputTbl.Columns.Add("EndRange") | Out-Null
69+
$OutputTbl.Columns.Add("Country") | Out-Null
70+
$OutputTbl.Columns.Add("City") | Out-Null
71+
$OutputTbl.Columns.Add("Zip") | Out-Null
72+
$OutputTbl.Columns.Add("ISP") | Out-Null
73+
$OutputTbl.Columns.Add("Ports") | Out-Null
74+
}
75+
76+
Process
77+
{
78+
# Set cap file path
79+
if( -not $capPath){
80+
Write-Host "No cap file provided."
81+
return
82+
}
83+
84+
# Verify cap path
85+
If ((Test-Path $capPath) -eq $True) {
86+
Write-Verbose "The cap path is valid: $capPath"
87+
}else{
88+
Write-Host "The cap path is invalid: $capPath"
89+
return
90+
}
91+
92+
# Set DstIp filter
93+
if(-not $IpFilter){
94+
$CurrentIpFilter = ""
95+
}else{
96+
$CurrentIpFilter = "-Yip.addr==$IpFilter"
97+
}
98+
99+
# Execute tshark command (parse cap)
100+
Write-Verbose "Parsing cap file to variable"
101+
try{
102+
103+
#$TsharkCmdOutput = &$TsharkPath -r $capPath -T fields -e ip.src -e ip.dst -e tcp.dstport $DstIpFilter -E header=y -E separator=`, -E occurrence=f
104+
$a1 = "-r$capPath"
105+
$a2 = "-Tfields"
106+
$a3 = "-eip.src"
107+
$a4 = "-eip.dst"
108+
$a5 = "-etcp.dstport"
109+
$a7 = "-Eheader=y"
110+
$a8 = "-Eseparator=`,"
111+
$a9 = "-Eoccurrence=f"
112+
113+
$TsharkCmdOutput = &$TsharkPath $a1 $a2 $a3 $a4 $a5 $CurrentIpFilter $a7 $a8 $a9
114+
115+
}catch{
116+
Write-Warning "Bummer. Something went wrong..."
117+
return
118+
}
119+
120+
# Import data tshark parsed
121+
$CapData = ConvertFrom-Csv -InputObject $TsharkCmdOutput
122+
123+
# Import all parsed data (SrcIp, DstIp, Port) into $TblPortInfo
124+
$capDataIpOnly = $CapData | select ip.src,ip.dst -Unique | Sort-Object ip.src | select -Skip 1
125+
126+
# Status user
127+
Write-Host "Getting IP information..."
128+
129+
# Lookup source IP owner and location
130+
$capDataIpOnly | ForEach-Object {
131+
132+
# Get source IP
133+
$IpAddress = $_.'ip.src'
134+
$CurrentDest = $_.'ip.dst'
135+
136+
# Send whois request to arin via restful api
137+
$web = new-object system.net.webclient
138+
[xml]$results = $web.DownloadString("http://whois.arin.net/rest/ip/$IpAddress")
139+
140+
141+
# Parse data from responses
142+
$IpOwner = $results.net.name
143+
$IpStart = $results.net.startAddress
144+
$IpEnd = $results.net.endaddress
145+
$ArinRef = "http://whois.arin.net/rest/ip/$IpAddress"
146+
$IpCountry = ""
147+
$IpCity = ""
148+
$IpZip = ""
149+
$IpISP = ""
150+
151+
# Put results in the data table
152+
$TblIPInfo.Rows.Add("$CurrentDest",
153+
"$IpAddress",
154+
"$IpOwner",
155+
"$ArinRef",
156+
"$IpStart",
157+
"$IpEnd",
158+
"$IpCountry",
159+
"$IpCity",
160+
"$IpZip",
161+
"$IpISP") | Out-Null
162+
163+
# status the user
164+
Write-Verbose "Dest:$CurrentDest Src:$IpAddress Owner: $IpOwner ($IpCountry) ($IpStart -$IpEnd)"
165+
166+
}
167+
168+
# Status user
169+
Write-Host "Consolidating ports..."
170+
171+
# Get list of unique src ips
172+
$CapSrcIps = $CapData | select ip.src,ip.dst -Unique | Sort-Object ip.src
173+
174+
# Iterate through each IP
175+
$CapSrcIps |
176+
ForEach-Object{
177+
178+
# Combine ports with list
179+
$SourceIp = $_.'ip.src'
180+
$DestinationIp = $_.'ip.dst'
181+
182+
# loop through full list
183+
$CapData | select ip.src,ip.dst,tcp.dstport -Unique |
184+
ForEach-Object{
185+
186+
$Src = $_.'ip.src'
187+
$Dst = $_.'ip.dst'
188+
$Port = $_.'tcp.dstport'
189+
190+
# check if it is current ip
191+
if(($SourceIp -eq $Src) -and ($DestinationIp -eq $Dst)){
192+
193+
# build port list
194+
$ports = "$ports$port,"
195+
$GoodSrc = $Src
196+
$GoodDst = $Dst
197+
$GoodPort = $Port
198+
}
199+
}
200+
201+
# remove trailing
202+
$ports = $ports.Substring(0,$ports.Length-1)
203+
204+
# Add ip info to final list
205+
$TblPortInfo.Rows.Add($GoodSrc,$GoodDst,$ports) | out-null
206+
207+
# clear port list
208+
$ports = ""
209+
}
210+
211+
# Status user
212+
Write-Host "Merging records..."
213+
214+
# Combine Lists
215+
$TblPortInfo |
216+
ForEach-Object{
217+
218+
# Get port information
219+
$PortIpSrc = $_.SrcIp
220+
$PortIpDst = $_.DstIp
221+
$PortIpPorts = $_.Ports
222+
223+
# Get IP information & merge
224+
$TblIPInfo |
225+
ForEach-Object{
226+
227+
# Get ip info
228+
$IpInfoIpSrc = $_.IpSrc
229+
$IpInfoIpDst = $_.IpDest
230+
$IpInfoOwner = $_.Owner
231+
$ArinRef = $_.ArinRef
232+
$IpInfoStartRange = $_.StartRange
233+
$IpInfoEndRange = $_.EndRange
234+
$IpInfoCountry = $_.Country
235+
$IpInfoCity = $_.City
236+
$IpInfoZip = $_.Zip
237+
$IpInfoISP = $_.ISP
238+
239+
# Check for ip match
240+
if (($PortIpSrc -eq $IpInfoIpSrc) -and ($PortIpDst -eq $IpInfoIpDst)){
241+
242+
# Put results in the data table
243+
$OutputTbl.Rows.Add($IpInfoIpSrc,
244+
$IpInfoIpDst,
245+
$IpInfoOwner,
246+
$ArinRef,
247+
$IpInfoStartRange,
248+
$IpInfoEndRange,
249+
$IpInfoCountry,
250+
$IpInfoCity,
251+
$IpInfoZip,
252+
$IpInfoISP,
253+
$PortIpPorts) | Out-Null
254+
}
255+
}
256+
}
257+
}
258+
259+
End
260+
{
261+
# Status user
262+
Write-Host "Done."
263+
264+
# Return the full result set
265+
$OutputTbl | Sort-Object Owner -Unique
266+
}
267+
}

0 commit comments

Comments
 (0)