packet_find

#!/bin/sh
# Adapted from: http://eatingsecurity.blogspot.com/2007/11/for-loop-with-tcpdump.html

# Check for root
[ "$(id -u)" -ne 0 ] && echo "This script must be run using sudo!" && exit 1

# Let's talk about how to use this thing!
usage()
{
cat <<EOF

Packet_Find - Usage

     Options:

        -d              Specify date to use during search
        -f              Use BPF Expression (MANDATORY)
        -h              Help
        
        Ex. Search date and filter --> sudo ./packet_find.sh -d "2017-04-28" -f "host 192.168.1.1"
        Ex. Search filter --> sudo ./packet_find.sh -f "host 192.168.1.1"

Usage: $0

EOF
}

# Let's declare some options!
unset date
while getopts "d:f:h" OPTION
do
     case $OPTION in

         h)
                usage
                exit 0
              ;;
         f)
                bpfexp=$OPTARG
              ;;
         d)
                date=$OPTARG
              ;;
     esac
done

# Let's set the output directory!
outdir=/tmp

# If output dir is not created, then create it.
if [ ! -d $outdir ]; then
    mkdir $outdir
fi

# Remove pre-existing merged PCAP
if [ -f $outdir/all.pcap ]; then 
    rm -f $outdir/all.pcap
fi

# If date was specified, then execute...
if [  "$date" ]; then
    # For each sensor interface...
    for a in $( ls /nsm/sensor_data/ ); do
        #Check dailylogs for the specified date
        for c in $( ls /nsm/sensor_data/$a/dailylogs/$date ); do
		tcpdump -r /nsm/sensor_data/$a/dailylogs/$date/$c -w $outdir/$c.pcap $bpfexp
	done
    done
# Otherwise, if date wasn't specified, run against all PCAPs.
else
    for a in $( ls /nsm/sensor_data/ ); do
        for b in $( ls /nsm/sensor_data/$a/dailylogs ) ; do
            for c in $( ls /nsm/sensor_data/$a/dailylogs/$b ); do
                tcpdump -r /nsm/sensor_data/$a/dailylogs/$b/$c -w $outdir/$c.pcap $bpfexp
            done
        done
    done
fi

# Clean up PCAPs with no data...
for file in $( ls $outdir/*.pcap ); do
    # If file has size of 24, it has no data so rm file
    if [ "`ls -l $file | awk '{print $5}'`" = "24" ]; then
        rm -f "$file"
    fi
done

# Merge all PCAPs into a single PCAP for analysis
mergecap -w /tmp/all.pcap /tmp/*.pcap 2>/dev/null

if [ -f "$outdir/all.pcap" ]; then
    echo ""
    echo "SUCCESS!"
    echo ""
    echo "Your merged PCAP has been written to $outdir/all.pcap!"
    echo ""
else
    echo ""
    echo "Sorry, no match was found :( !"
    echo ""
fi

# Clean up all PCAPs, except merged PCAP
for file in $( ls $outdir/snort.log.*.pcap 2>/dev/null ); do
        rm -f "$file"
done