notebook.community

Edit and run

Import modules





In [104]:



    


import pandas as pd
import json
import re
import warnings
warnings.filterwarnings('ignore')

pcap_data = pd.read_csv('pcap_export.csv', index_col='No.')



    











In [105]:



    


pcap_data



    


















    
Out[105]:











  
    

      
      Time
      Source
      Destination
      Protocol
      Length
      Info
    

    

      No.
      
      
      
      
      
      
    

  
  
    

      1
      0.000000e+00
      10.25.22.253
      10.25.22.250
      TCP
      62
      2546  >  80 [SYN] Seq=0 Win=64240 Len=0 MSS=14...
    

    

      2
      3.500000e-05
      10.25.22.250
      10.25.22.253
      TCP
      62
      80  >  2546 [SYN, ACK] Seq=0 Ack=1 Win=14600 L...
    

    

      3
      2.250000e-04
      10.25.22.253
      10.25.22.250
      TCP
      60
      2546  >  80 [ACK] Seq=1 Ack=1 Win=64240 Len=0
    

    

      4
      4.550000e-04
      10.25.22.253
      10.25.22.250
      HTTP
      360
      GET / HTTP/1.1
    

    

      5
      4.820000e-04
      10.25.22.250
      10.25.22.253
      TCP
      54
      80  >  2546 [ACK] Seq=1 Ack=307 Win=15544 Len=0
    

    

      6
      9.570000e-04
      10.25.22.250
      10.25.22.253
      HTTP
      1315
      HTTP/1.1 200 OK  (text/html)
    

    

      7
      3.018000e-03
      10.25.22.253
      10.25.22.250
      HTTP
      340
      GET /default.css HTTP/1.1
    

    

      8
      3.181000e-03
      10.25.22.250
      10.25.22.253
      TCP
      1514
      [TCP segment of a reassembled PDU]
    

    

      9
      3.298000e-03
      10.25.22.250
      10.25.22.253
      HTTP
      1194
      HTTP/1.1 200 OK  (text/css)
    

    

      10
      3.531000e-03
      10.25.22.253
      10.25.22.250
      TCP
      60
      2546  >  80 [ACK] Seq=593 Ack=3862 Win=64240 L...
    

    

      11
      3.929300e-02
      10.25.22.253
      10.25.22.250
      HTTP
      344
      GET /img/stripes.gif HTTP/1.1
    

    

      12
      3.967200e-02
      10.25.22.250
      10.25.22.253
      HTTP
      579
      HTTP/1.1 404 Not Found  (text/html)
    

    

      13
      9.232000e-02
      10.25.22.253
      10.25.22.250
      HTTP
      267
      GET /favicon.ico HTTP/1.1
    

    

      14
      9.259300e-02
      10.25.22.250
      10.25.22.253
      HTTP
      575
      HTTP/1.1 404 Not Found  (text/html)
    

    

      15
      3.035210e-01
      10.25.22.253
      10.25.22.250
      TCP
      60
      2546  >  80 [ACK] Seq=1096 Ack=4908 Win=63194 ...
    

    

      16
      4.466444e+00
      10.25.22.253
      10.25.22.250
      HTTP
      442
      GET /files/TrafficSystemNetworkMap.pdf HTTP/1.1
    

    

      17
      4.466706e+00
      10.25.22.250
      10.25.22.253
      TCP
      14654
      [TCP segment of a reassembled PDU]
    

    

      18
      4.466912e+00
      10.25.22.253
      10.25.22.250
      TCP
      60
      2546  >  80 [ACK] Seq=1484 Ack=19508 Win=58400...
    

    

      19
      4.466927e+00
      10.25.22.250
      10.25.22.253
      TCP
      16114
      [TCP segment of a reassembled PDU]
    

    

      20
      4.467095e+00
      10.25.22.253
      10.25.22.250
      TCP
      60
      2546  >  80 [ACK] Seq=1484 Ack=35568 Win=42340...
    

    

      21
      4.467107e+00
      10.25.22.250
      10.25.22.253
      TCP
      16114
      [TCP segment of a reassembled PDU]
    

    

      22
      4.467273e+00
      10.25.22.253
      10.25.22.250
      TCP
      60
      2546  >  80 [ACK] Seq=1484 Ack=51628 Win=26280...
    

    

      23
      4.467324e+00
      10.25.22.250
      10.25.22.253
      TCP
      19034
      [TCP segment of a reassembled PDU]
    

    

      24
      4.467507e+00
      10.25.22.253
      10.25.22.250
      TCP
      60
      2546  >  80 [ACK] Seq=1484 Ack=70608 Win=7300 ...
    

    

      25
      4.467518e+00
      10.25.22.250
      10.25.22.253
      TCP
      7354
      [TCP Window Full] [TCP segment of a reassemble...
    

    

      26
      4.467639e+00
      10.25.22.253
      10.25.22.250
      TCP
      60
      [TCP ZeroWindow] 2546  >  80 [ACK] Seq=1484 Ac...
    

    

      27
      4.467978e+00
      10.25.22.253
      10.25.22.250
      TCP
      60
      [TCP Window Update] 2546  >  80 [ACK] Seq=1484...
    

    

      28
      4.467988e+00
      10.25.22.250
      10.25.22.253
      TCP
      2974
      [TCP segment of a reassembled PDU]
    

    

      29
      4.468165e+00
      10.25.22.253
      10.25.22.250
      TCP
      60
      2546  >  80 [ACK] Seq=1484 Ack=80828 Win=840 L...
    

    

      30
      4.468730e+00
      10.25.22.253
      10.25.22.250
      TCP
      60
      [TCP Window Update] 2546  >  80 [ACK] Seq=1484...
    

    

      ...
      ...
      ...
      ...
      ...
      ...
      ...
    

    

      170545
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135877788 Ack=1 Win=404...
    

    

      170546
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135879136 Ack=1 Win=404...
    

    

      170547
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135880484 Ack=1 Win=404...
    

    

      170548
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135881832 Ack=1 Win=404...
    

    

      170549
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135883180 Ack=1 Win=404...
    

    

      170550
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135884528 Ack=1 Win=404...
    

    

      170551
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135885876 Ack=1 Win=404...
    

    

      170552
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135887224 Ack=1 Win=404...
    

    

      170553
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      653
      80  >  51085 [ACK] Seq=135888572 Ack=1 Win=404...
    

    

      170554
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135889159 Ack=1 Win=404...
    

    

      170555
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135890507 Ack=1 Win=404...
    

    

      170556
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135891855 Ack=1 Win=404...
    

    

      170557
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135893203 Ack=1 Win=404...
    

    

      170558
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135894551 Ack=1 Win=404...
    

    

      170559
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135895899 Ack=1 Win=404...
    

    

      170560
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135897247 Ack=1 Win=404...
    

    

      170561
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135898595 Ack=1 Win=404...
    

    

      170562
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135899943 Ack=1 Win=404...
    

    

      170563
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135901291 Ack=1 Win=404...
    

    

      170564
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135902639 Ack=1 Win=404...
    

    

      170565
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135903987 Ack=1 Win=404...
    

    

      170566
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135905335 Ack=1 Win=404...
    

    

      170567
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135906683 Ack=1 Win=404...
    

    

      170568
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135908031 Ack=1 Win=404...
    

    

      170569
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135909379 Ack=1 Win=404...
    

    

      170570
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135910727 Ack=1 Win=404...
    

    

      170571
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135912075 Ack=1 Win=404...
    

    

      170572
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135913423 Ack=1 Win=404...
    

    

      170573
      1.319066e+06
      10.16.92.103
      10.16.92.79
      TCP
      1414
      80  >  51085 [ACK] Seq=135914771 Ack=1 Win=404...
    

    

      170574
      1.319066e+06
      10.16.92.79
      10.16.92.103
      TCP
      66
      51085  >  80 [ACK] Seq=1 Ack=135916119 Win=666...
    

  



170574 rows × 6 columns

Rename dataframe for tutorial





In [106]:



    


dataframe = pcap_data



    











In [107]:



    


src_dst = dataframe[["Source","Destination"]]



    











In [108]:



    


src_dst.sample(10)



    


















    
Out[108]:











  
    

      
      Source
      Destination
    

    

      No.
      
      
    

  
  
    

      16018
      10.25.22.253
      192.190.173.45
    

    

      37930
      10.16.92.79
      10.16.92.103
    

    

      60240
      10.16.92.103
      10.16.92.79
    

    

      16772
      192.190.173.45
      10.25.22.253
    

    

      98884
      10.16.92.103
      10.16.92.79
    

    

      18082
      10.25.22.253
      10.21.22.253
    

    

      127799
      10.16.92.103
      10.16.92.79
    

    

      109308
      10.16.92.103
      10.16.92.79
    

    

      113511
      10.16.92.79
      10.16.92.103
    

    

      68852
      10.16.92.103
      10.16.92.79

IP Matcher to filter out hostnames





In [109]:



    


def ip_matcher(address):
    # Used to validate if string is an ipaddress
    ip = re.match(
        '^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$', address)
    if ip:
        return True
    else:
        return False



    











In [110]:



    


src_dst.rename(columns={"Source":"source","Destination":"target"}, inplace=True)
src_dst['valid_src'] = src_dst.source.apply(ip_matcher)
src_dst['valid_target'] = src_dst.target.apply(ip_matcher)



    











In [111]:



    


valid_src_dest = src_dst[(src_dst.valid_src==True) & (src_dst.valid_target==True)]



    











In [112]:



    


grouped_src_dst = valid_src_dest.groupby(["source","target"]).size().reset_index()



    











In [113]:



    


unique_ips = pd.Index(grouped_src_dst['source']
                      .append(grouped_src_dst['target'])
                      .reset_index(drop=True).unique())



    











In [133]:



    


unique_ips[:5]



    


















    
Out[133]:








Index([u'0.0.0.0', u'10.16.11.5', u'10.16.92.103', u'10.16.92.79',
       u'10.2.2.2'],
      dtype='object')

















In [115]:



    


group_dict = {}
counter = 0
for ip in unique_ips:
    breakout_ip = re.match("^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$", ip)
    if breakout_ip:
        net_id = '.'.join(breakout_ip.group(1,2,3))
        if net_id not in group_dict:
            counter += 1
            group_dict[net_id] = counter
        else:
            pass



    











In [116]:



    


grouped_src_dst.rename(columns={0:'count'}, inplace=True)
temp_links_list = list(grouped_src_dst.apply(lambda row: {"source": row['source'], "target": row['target'], "value": row['count']}, axis=1))



    











In [134]:



    


grouped_src_dst.head()



    


















    
Out[134]:











  
    

      
      source
      target
      count
    

  
  
    

      0
      0.0.0.0
      255.255.255.255
      157
    

    

      1
      10.16.11.5
      10.25.22.253
      24
    

    

      2
      10.16.92.103
      10.16.92.79
      105742
    

    

      3
      10.16.92.79
      10.16.92.103
      36543
    

    

      4
      10.2.2.2
      10.22.11.9
      3410
    

  




















In [118]:



    


temp_links_list



    


















    
Out[118]:








[{'source': '0.0.0.0', 'target': '255.255.255.255', 'value': 157},
 {'source': '10.16.11.5', 'target': '10.25.22.253', 'value': 24},
 {'source': '10.16.92.103', 'target': '10.16.92.79', 'value': 105742},
 {'source': '10.16.92.79', 'target': '10.16.92.103', 'value': 36543},
 {'source': '10.2.2.2', 'target': '10.22.11.9', 'value': 3410},
 {'source': '10.2.2.2', 'target': '10.25.22.253', 'value': 57},
 {'source': '10.21.22.1', 'target': '10.21.22.22', 'value': 1},
 {'source': '10.21.22.1', 'target': '10.21.22.23', 'value': 1},
 {'source': '10.21.22.1', 'target': '10.21.22.24', 'value': 1},
 {'source': '10.21.22.1', 'target': '10.21.22.253', 'value': 19},
 {'source': '10.21.22.10', 'target': '10.21.22.22', 'value': 54},
 {'source': '10.21.22.10', 'target': '10.21.22.23', 'value': 96},
 {'source': '10.21.22.10', 'target': '10.21.22.24', 'value': 156},
 {'source': '10.21.22.10', 'target': '10.21.22.253', 'value': 14},
 {'source': '10.21.22.22', 'target': '10.21.22.1', 'value': 3},
 {'source': '10.21.22.22', 'target': '10.21.22.10', 'value': 40},
 {'source': '10.21.22.22', 'target': '10.21.22.23', 'value': 6},
 {'source': '10.21.22.22', 'target': '10.21.22.24', 'value': 6},
 {'source': '10.21.22.22', 'target': '10.21.22.253', 'value': 20},
 {'source': '10.21.22.23', 'target': '10.21.22.1', 'value': 3},
 {'source': '10.21.22.23', 'target': '10.21.22.10', 'value': 81},
 {'source': '10.21.22.23', 'target': '10.21.22.22', 'value': 6},
 {'source': '10.21.22.23', 'target': '10.21.22.24', 'value': 6},
 {'source': '10.21.22.23', 'target': '10.21.22.253', 'value': 34},
 {'source': '10.21.22.24', 'target': '10.21.22.1', 'value': 5},
 {'source': '10.21.22.24', 'target': '10.21.22.10', 'value': 158},
 {'source': '10.21.22.24', 'target': '10.21.22.22', 'value': 10},
 {'source': '10.21.22.24', 'target': '10.21.22.23', 'value': 10},
 {'source': '10.21.22.24', 'target': '10.21.22.253', 'value': 16},
 {'source': '10.21.22.253', 'target': '10.21.22.1', 'value': 18},
 {'source': '10.21.22.253', 'target': '10.21.22.10', 'value': 16},
 {'source': '10.21.22.253', 'target': '10.21.22.22', 'value': 21},
 {'source': '10.21.22.253', 'target': '10.21.22.23', 'value': 39},
 {'source': '10.21.22.253', 'target': '10.21.22.24', 'value': 18},
 {'source': '10.21.22.253', 'target': '10.25.22.253', 'value': 4041},
 {'source': '10.21.22.253', 'target': '74.125.22.82', 'value': 339},
 {'source': '10.21.22.253', 'target': '8.8.8.8', 'value': 13},
 {'source': '10.21.22.253', 'target': '81.169.180.37', 'value': 55},
 {'source': '10.22.11.9', 'target': '10.2.2.2', 'value': 2724},
 {'source': '10.25.22.1', 'target': '10.25.22.253', 'value': 1},
 {'source': '10.25.22.2', 'target': '10.25.22.253', 'value': 1},
 {'source': '10.25.22.20', 'target': '10.25.22.253', 'value': 4},
 {'source': '10.25.22.20', 'target': '10.25.22.58', 'value': 363},
 {'source': '10.25.22.200', 'target': '10.25.22.253', 'value': 1},
 {'source': '10.25.22.21', 'target': '10.25.22.253', 'value': 1},
 {'source': '10.25.22.22', 'target': '10.25.22.252', 'value': 300},
 {'source': '10.25.22.22', 'target': '10.25.22.253', 'value': 1},
 {'source': '10.25.22.22', 'target': '255.255.255.255', 'value': 30},
 {'source': '10.25.22.23', 'target': '10.25.22.253', 'value': 21},
 {'source': '10.25.22.24', 'target': '10.25.22.253', 'value': 1},
 {'source': '10.25.22.25', 'target': '10.25.22.253', 'value': 1},
 {'source': '10.25.22.250', 'target': '10.25.22.253', 'value': 53},
 {'source': '10.25.22.252', 'target': '10.25.22.22', 'value': 381},
 {'source': '10.25.22.252', 'target': '10.25.22.253', 'value': 1},
 {'source': '10.25.22.252', 'target': '10.25.22.30', 'value': 275},
 {'source': '10.25.22.252', 'target': '216.22.25.175', 'value': 67},
 {'source': '10.25.22.252', 'target': '8.8.8.8', 'value': 17},
 {'source': '10.25.22.253', 'target': '10.16.11.5', 'value': 22},
 {'source': '10.25.22.253', 'target': '10.2.2.2', 'value': 41},
 {'source': '10.25.22.253', 'target': '10.21.22.253', 'value': 2840},
 {'source': '10.25.22.253', 'target': '10.25.22.1', 'value': 1},
 {'source': '10.25.22.253', 'target': '10.25.22.2', 'value': 1},
 {'source': '10.25.22.253', 'target': '10.25.22.20', 'value': 4},
 {'source': '10.25.22.253', 'target': '10.25.22.200', 'value': 1},
 {'source': '10.25.22.253', 'target': '10.25.22.21', 'value': 1},
 {'source': '10.25.22.253', 'target': '10.25.22.22', 'value': 1},
 {'source': '10.25.22.253', 'target': '10.25.22.23', 'value': 22},
 {'source': '10.25.22.253', 'target': '10.25.22.24', 'value': 1},
 {'source': '10.25.22.253', 'target': '10.25.22.25', 'value': 1},
 {'source': '10.25.22.253', 'target': '10.25.22.250', 'value': 65},
 {'source': '10.25.22.253', 'target': '10.25.22.252', 'value': 1},
 {'source': '10.25.22.253', 'target': '10.25.22.255', 'value': 3},
 {'source': '10.25.22.253', 'target': '10.25.22.30', 'value': 4},
 {'source': '10.25.22.253', 'target': '10.25.22.58', 'value': 1421},
 {'source': '10.25.22.253', 'target': '165.254.138.136', 'value': 116},
 {'source': '10.25.22.253', 'target': '165.254.158.56', 'value': 10},
 {'source': '10.25.22.253', 'target': '173.194.43.47', 'value': 11},
 {'source': '10.25.22.253', 'target': '192.190.173.45', 'value': 511},
 {'source': '10.25.22.253', 'target': '192.204.3.75', 'value': 263},
 {'source': '10.25.22.253', 'target': '199.7.57.72', 'value': 10},
 {'source': '10.25.22.253', 'target': '208.80.154.224', 'value': 7},
 {'source': '10.25.22.253', 'target': '208.80.154.225', 'value': 41},
 {'source': '10.25.22.253', 'target': '208.80.154.234', 'value': 39},
 {'source': '10.25.22.253', 'target': '208.80.154.240', 'value': 105},
 {'source': '10.25.22.253', 'target': '54.230.49.239', 'value': 7},
 {'source': '10.25.22.253', 'target': '63.245.217.36', 'value': 6},
 {'source': '10.25.22.253', 'target': '69.16.175.10', 'value': 86},
 {'source': '10.25.22.253', 'target': '69.195.141.178', 'value': 11},
 {'source': '10.25.22.253', 'target': '72.167.239.239', 'value': 10},
 {'source': '10.25.22.253', 'target': '72.21.195.198', 'value': 35},
 {'source': '10.25.22.253', 'target': '72.21.203.211', 'value': 4},
 {'source': '10.25.22.253', 'target': '72.21.214.3', 'value': 73},
 {'source': '10.25.22.253', 'target': '72.21.215.52', 'value': 27},
 {'source': '10.25.22.253', 'target': '74.125.226.199', 'value': 11},
 {'source': '10.25.22.253', 'target': '74.125.226.228', 'value': 13},
 {'source': '10.25.22.253', 'target': '74.125.226.239', 'value': 11},
 {'source': '10.25.22.253', 'target': '74.125.226.242', 'value': 139},
 {'source': '10.25.22.253', 'target': '74.125.226.251', 'value': 24},
 {'source': '10.25.22.253', 'target': '75.99.175.194', 'value': 36},
 {'source': '10.25.22.253', 'target': '8.8.8.8', 'value': 305},
 {'source': '10.25.22.253', 'target': '82.103.134.102', 'value': 53},
 {'source': '10.25.22.253', 'target': '82.103.140.42', 'value': 9},
 {'source': '10.25.22.254', 'target': '10.25.22.253', 'value': 1},
 {'source': '10.25.22.30', 'target': '10.25.22.252', 'value': 264},
 {'source': '10.25.22.30', 'target': '10.25.22.253', 'value': 4},
 {'source': '10.25.22.58', 'target': '10.25.22.20', 'value': 350},
 {'source': '10.25.22.58', 'target': '10.25.22.253', 'value': 1277},
 {'source': '10.25.22.58', 'target': '10.25.22.255', 'value': 3},
 {'source': '165.254.138.136', 'target': '10.25.22.253', 'value': 198},
 {'source': '165.254.158.56', 'target': '10.25.22.253', 'value': 6},
 {'source': '173.194.43.47', 'target': '10.25.22.253', 'value': 11},
 {'source': '192.190.173.45', 'target': '10.25.22.253', 'value': 1000},
 {'source': '192.204.3.75', 'target': '10.25.22.253', 'value': 630},
 {'source': '199.7.57.72', 'target': '10.25.22.253', 'value': 12},
 {'source': '208.80.154.224', 'target': '10.25.22.253', 'value': 6},
 {'source': '208.80.154.225', 'target': '10.25.22.253', 'value': 66},
 {'source': '208.80.154.234', 'target': '10.25.22.253', 'value': 52},
 {'source': '208.80.154.240', 'target': '10.25.22.253', 'value': 180},
 {'source': '216.22.25.175', 'target': '10.25.22.252', 'value': 104},
 {'source': '54.230.49.239', 'target': '10.25.22.253', 'value': 7},
 {'source': '63.245.217.36', 'target': '10.25.22.253', 'value': 4},
 {'source': '69.16.175.10', 'target': '10.25.22.253', 'value': 211},
 {'source': '69.195.141.178', 'target': '10.25.22.253', 'value': 11},
 {'source': '72.167.239.239', 'target': '10.25.22.253', 'value': 14},
 {'source': '72.21.195.198', 'target': '10.25.22.253', 'value': 61},
 {'source': '72.21.203.211', 'target': '10.25.22.253', 'value': 2},
 {'source': '72.21.214.3', 'target': '10.25.22.253', 'value': 88},
 {'source': '72.21.215.52', 'target': '10.25.22.253', 'value': 47},
 {'source': '74.125.22.82', 'target': '10.21.22.253', 'value': 546},
 {'source': '74.125.226.199', 'target': '10.25.22.253', 'value': 11},
 {'source': '74.125.226.228', 'target': '10.25.22.253', 'value': 9},
 {'source': '74.125.226.239', 'target': '10.25.22.253', 'value': 11},
 {'source': '74.125.226.242', 'target': '10.25.22.253', 'value': 244},
 {'source': '74.125.226.251', 'target': '10.25.22.253', 'value': 16},
 {'source': '75.99.175.194', 'target': '10.25.22.253', 'value': 36},
 {'source': '8.8.8.8', 'target': '10.21.22.253', 'value': 13},
 {'source': '8.8.8.8', 'target': '10.25.22.252', 'value': 17},
 {'source': '8.8.8.8', 'target': '10.25.22.253', 'value': 304},
 {'source': '81.169.180.37', 'target': '10.21.22.253', 'value': 51},
 {'source': '82.103.134.102', 'target': '10.25.22.253', 'value': 67},
 {'source': '82.103.140.42', 'target': '10.25.22.253', 'value': 10}]

















In [119]:



    


len(unique_ips)



    


















    
Out[119]:








60

















In [120]:



    


links_list = []
for link in temp_links_list:
    record = {"value":link['value'], "source":unique_ips.get_loc(link['source']),
     "target": unique_ips.get_loc(link['target'])}
    links_list.append(record)



    











In [121]:



    


nodes_list = []

for ip in unique_ips:
    breakout_ip = re.match("^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$", ip)
    if breakout_ip:
        net_id = '.'.join(breakout_ip.group(1,2,3))
        nodes_list.append({"name":ip, "group": group_dict.get(net_id)})



    











In [136]:



    


links_list[:5]



    


















    
Out[136]:








[{'source': 0, 'target': 58, 'value': 157},
 {'source': 1, 'target': 23, 'value': 24},
 {'source': 2, 'target': 3, 'value': 105742},
 {'source': 3, 'target': 2, 'value': 36543},
 {'source': 4, 'target': 11, 'value': 3410}]

















In [135]:



    


nodes_list[:5]



    


















    
Out[135]:








[{'group': 1, 'name': '0.0.0.0'},
 {'group': 2, 'name': '10.16.11.5'},
 {'group': 3, 'name': '10.16.92.103'},
 {'group': 3, 'name': '10.16.92.79'},
 {'group': 4, 'name': '10.2.2.2'}]

















In [124]:



    


json_prep = {"links":links_list, "nodes":nodes_list}

json_prep.keys()



    


















    
Out[124]:








['nodes', 'links']

















In [125]:



    


json_dump = json.dumps(json_prep, indent=1, sort_keys=True)



    











In [126]:



    


print json_dump



    


















    






{
 "links": [
  {
   "source": 0, 
   "target": 58, 
   "value": 157
  }, 
  {
   "source": 1, 
   "target": 23, 
   "value": 24
  }, 
  {
   "source": 2, 
   "target": 3, 
   "value": 105742
  }, 
  {
   "source": 3, 
   "target": 2, 
   "value": 36543
  }, 
  {
   "source": 4, 
   "target": 11, 
   "value": 3410
  }, 
  {
   "source": 4, 
   "target": 23, 
   "value": 57
  }, 
  {
   "source": 5, 
   "target": 7, 
   "value": 1
  }, 
  {
   "source": 5, 
   "target": 8, 
   "value": 1
  }, 
  {
   "source": 5, 
   "target": 9, 
   "value": 1
  }, 
  {
   "source": 5, 
   "target": 10, 
   "value": 19
  }, 
  {
   "source": 6, 
   "target": 7, 
   "value": 54
  }, 
  {
   "source": 6, 
   "target": 8, 
   "value": 96
  }, 
  {
   "source": 6, 
   "target": 9, 
   "value": 156
  }, 
  {
   "source": 6, 
   "target": 10, 
   "value": 14
  }, 
  {
   "source": 7, 
   "target": 5, 
   "value": 3
  }, 
  {
   "source": 7, 
   "target": 6, 
   "value": 40
  }, 
  {
   "source": 7, 
   "target": 8, 
   "value": 6
  }, 
  {
   "source": 7, 
   "target": 9, 
   "value": 6
  }, 
  {
   "source": 7, 
   "target": 10, 
   "value": 20
  }, 
  {
   "source": 8, 
   "target": 5, 
   "value": 3
  }, 
  {
   "source": 8, 
   "target": 6, 
   "value": 81
  }, 
  {
   "source": 8, 
   "target": 7, 
   "value": 6
  }, 
  {
   "source": 8, 
   "target": 9, 
   "value": 6
  }, 
  {
   "source": 8, 
   "target": 10, 
   "value": 34
  }, 
  {
   "source": 9, 
   "target": 5, 
   "value": 5
  }, 
  {
   "source": 9, 
   "target": 6, 
   "value": 158
  }, 
  {
   "source": 9, 
   "target": 7, 
   "value": 10
  }, 
  {
   "source": 9, 
   "target": 8, 
   "value": 10
  }, 
  {
   "source": 9, 
   "target": 10, 
   "value": 16
  }, 
  {
   "source": 10, 
   "target": 5, 
   "value": 18
  }, 
  {
   "source": 10, 
   "target": 6, 
   "value": 16
  }, 
  {
   "source": 10, 
   "target": 7, 
   "value": 21
  }, 
  {
   "source": 10, 
   "target": 8, 
   "value": 39
  }, 
  {
   "source": 10, 
   "target": 9, 
   "value": 18
  }, 
  {
   "source": 10, 
   "target": 23, 
   "value": 4041
  }, 
  {
   "source": 10, 
   "target": 47, 
   "value": 339
  }, 
  {
   "source": 10, 
   "target": 54, 
   "value": 13
  }, 
  {
   "source": 10, 
   "target": 55, 
   "value": 55
  }, 
  {
   "source": 11, 
   "target": 4, 
   "value": 2724
  }, 
  {
   "source": 12, 
   "target": 23, 
   "value": 1
  }, 
  {
   "source": 13, 
   "target": 23, 
   "value": 1
  }, 
  {
   "source": 14, 
   "target": 23, 
   "value": 4
  }, 
  {
   "source": 14, 
   "target": 26, 
   "value": 363
  }, 
  {
   "source": 15, 
   "target": 23, 
   "value": 1
  }, 
  {
   "source": 16, 
   "target": 23, 
   "value": 1
  }, 
  {
   "source": 17, 
   "target": 22, 
   "value": 300
  }, 
  {
   "source": 17, 
   "target": 23, 
   "value": 1
  }, 
  {
   "source": 17, 
   "target": 58, 
   "value": 30
  }, 
  {
   "source": 18, 
   "target": 23, 
   "value": 21
  }, 
  {
   "source": 19, 
   "target": 23, 
   "value": 1
  }, 
  {
   "source": 20, 
   "target": 23, 
   "value": 1
  }, 
  {
   "source": 21, 
   "target": 23, 
   "value": 53
  }, 
  {
   "source": 22, 
   "target": 17, 
   "value": 381
  }, 
  {
   "source": 22, 
   "target": 23, 
   "value": 1
  }, 
  {
   "source": 22, 
   "target": 25, 
   "value": 275
  }, 
  {
   "source": 22, 
   "target": 37, 
   "value": 67
  }, 
  {
   "source": 22, 
   "target": 54, 
   "value": 17
  }, 
  {
   "source": 23, 
   "target": 1, 
   "value": 22
  }, 
  {
   "source": 23, 
   "target": 4, 
   "value": 41
  }, 
  {
   "source": 23, 
   "target": 10, 
   "value": 2840
  }, 
  {
   "source": 23, 
   "target": 12, 
   "value": 1
  }, 
  {
   "source": 23, 
   "target": 13, 
   "value": 1
  }, 
  {
   "source": 23, 
   "target": 14, 
   "value": 4
  }, 
  {
   "source": 23, 
   "target": 15, 
   "value": 1
  }, 
  {
   "source": 23, 
   "target": 16, 
   "value": 1
  }, 
  {
   "source": 23, 
   "target": 17, 
   "value": 1
  }, 
  {
   "source": 23, 
   "target": 18, 
   "value": 22
  }, 
  {
   "source": 23, 
   "target": 19, 
   "value": 1
  }, 
  {
   "source": 23, 
   "target": 20, 
   "value": 1
  }, 
  {
   "source": 23, 
   "target": 21, 
   "value": 65
  }, 
  {
   "source": 23, 
   "target": 22, 
   "value": 1
  }, 
  {
   "source": 23, 
   "target": 59, 
   "value": 3
  }, 
  {
   "source": 23, 
   "target": 25, 
   "value": 4
  }, 
  {
   "source": 23, 
   "target": 26, 
   "value": 1421
  }, 
  {
   "source": 23, 
   "target": 27, 
   "value": 116
  }, 
  {
   "source": 23, 
   "target": 28, 
   "value": 10
  }, 
  {
   "source": 23, 
   "target": 29, 
   "value": 11
  }, 
  {
   "source": 23, 
   "target": 30, 
   "value": 511
  }, 
  {
   "source": 23, 
   "target": 31, 
   "value": 263
  }, 
  {
   "source": 23, 
   "target": 32, 
   "value": 10
  }, 
  {
   "source": 23, 
   "target": 33, 
   "value": 7
  }, 
  {
   "source": 23, 
   "target": 34, 
   "value": 41
  }, 
  {
   "source": 23, 
   "target": 35, 
   "value": 39
  }, 
  {
   "source": 23, 
   "target": 36, 
   "value": 105
  }, 
  {
   "source": 23, 
   "target": 38, 
   "value": 7
  }, 
  {
   "source": 23, 
   "target": 39, 
   "value": 6
  }, 
  {
   "source": 23, 
   "target": 40, 
   "value": 86
  }, 
  {
   "source": 23, 
   "target": 41, 
   "value": 11
  }, 
  {
   "source": 23, 
   "target": 42, 
   "value": 10
  }, 
  {
   "source": 23, 
   "target": 43, 
   "value": 35
  }, 
  {
   "source": 23, 
   "target": 44, 
   "value": 4
  }, 
  {
   "source": 23, 
   "target": 45, 
   "value": 73
  }, 
  {
   "source": 23, 
   "target": 46, 
   "value": 27
  }, 
  {
   "source": 23, 
   "target": 48, 
   "value": 11
  }, 
  {
   "source": 23, 
   "target": 49, 
   "value": 13
  }, 
  {
   "source": 23, 
   "target": 50, 
   "value": 11
  }, 
  {
   "source": 23, 
   "target": 51, 
   "value": 139
  }, 
  {
   "source": 23, 
   "target": 52, 
   "value": 24
  }, 
  {
   "source": 23, 
   "target": 53, 
   "value": 36
  }, 
  {
   "source": 23, 
   "target": 54, 
   "value": 305
  }, 
  {
   "source": 23, 
   "target": 56, 
   "value": 53
  }, 
  {
   "source": 23, 
   "target": 57, 
   "value": 9
  }, 
  {
   "source": 24, 
   "target": 23, 
   "value": 1
  }, 
  {
   "source": 25, 
   "target": 22, 
   "value": 264
  }, 
  {
   "source": 25, 
   "target": 23, 
   "value": 4
  }, 
  {
   "source": 26, 
   "target": 14, 
   "value": 350
  }, 
  {
   "source": 26, 
   "target": 23, 
   "value": 1277
  }, 
  {
   "source": 26, 
   "target": 59, 
   "value": 3
  }, 
  {
   "source": 27, 
   "target": 23, 
   "value": 198
  }, 
  {
   "source": 28, 
   "target": 23, 
   "value": 6
  }, 
  {
   "source": 29, 
   "target": 23, 
   "value": 11
  }, 
  {
   "source": 30, 
   "target": 23, 
   "value": 1000
  }, 
  {
   "source": 31, 
   "target": 23, 
   "value": 630
  }, 
  {
   "source": 32, 
   "target": 23, 
   "value": 12
  }, 
  {
   "source": 33, 
   "target": 23, 
   "value": 6
  }, 
  {
   "source": 34, 
   "target": 23, 
   "value": 66
  }, 
  {
   "source": 35, 
   "target": 23, 
   "value": 52
  }, 
  {
   "source": 36, 
   "target": 23, 
   "value": 180
  }, 
  {
   "source": 37, 
   "target": 22, 
   "value": 104
  }, 
  {
   "source": 38, 
   "target": 23, 
   "value": 7
  }, 
  {
   "source": 39, 
   "target": 23, 
   "value": 4
  }, 
  {
   "source": 40, 
   "target": 23, 
   "value": 211
  }, 
  {
   "source": 41, 
   "target": 23, 
   "value": 11
  }, 
  {
   "source": 42, 
   "target": 23, 
   "value": 14
  }, 
  {
   "source": 43, 
   "target": 23, 
   "value": 61
  }, 
  {
   "source": 44, 
   "target": 23, 
   "value": 2
  }, 
  {
   "source": 45, 
   "target": 23, 
   "value": 88
  }, 
  {
   "source": 46, 
   "target": 23, 
   "value": 47
  }, 
  {
   "source": 47, 
   "target": 10, 
   "value": 546
  }, 
  {
   "source": 48, 
   "target": 23, 
   "value": 11
  }, 
  {
   "source": 49, 
   "target": 23, 
   "value": 9
  }, 
  {
   "source": 50, 
   "target": 23, 
   "value": 11
  }, 
  {
   "source": 51, 
   "target": 23, 
   "value": 244
  }, 
  {
   "source": 52, 
   "target": 23, 
   "value": 16
  }, 
  {
   "source": 53, 
   "target": 23, 
   "value": 36
  }, 
  {
   "source": 54, 
   "target": 10, 
   "value": 13
  }, 
  {
   "source": 54, 
   "target": 22, 
   "value": 17
  }, 
  {
   "source": 54, 
   "target": 23, 
   "value": 304
  }, 
  {
   "source": 55, 
   "target": 10, 
   "value": 51
  }, 
  {
   "source": 56, 
   "target": 23, 
   "value": 67
  }, 
  {
   "source": 57, 
   "target": 23, 
   "value": 10
  }
 ], 
 "nodes": [
  {
   "group": 1, 
   "name": "0.0.0.0"
  }, 
  {
   "group": 2, 
   "name": "10.16.11.5"
  }, 
  {
   "group": 3, 
   "name": "10.16.92.103"
  }, 
  {
   "group": 3, 
   "name": "10.16.92.79"
  }, 
  {
   "group": 4, 
   "name": "10.2.2.2"
  }, 
  {
   "group": 5, 
   "name": "10.21.22.1"
  }, 
  {
   "group": 5, 
   "name": "10.21.22.10"
  }, 
  {
   "group": 5, 
   "name": "10.21.22.22"
  }, 
  {
   "group": 5, 
   "name": "10.21.22.23"
  }, 
  {
   "group": 5, 
   "name": "10.21.22.24"
  }, 
  {
   "group": 5, 
   "name": "10.21.22.253"
  }, 
  {
   "group": 6, 
   "name": "10.22.11.9"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.1"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.2"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.20"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.200"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.21"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.22"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.23"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.24"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.25"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.250"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.252"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.253"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.254"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.30"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.58"
  }, 
  {
   "group": 8, 
   "name": "165.254.138.136"
  }, 
  {
   "group": 9, 
   "name": "165.254.158.56"
  }, 
  {
   "group": 10, 
   "name": "173.194.43.47"
  }, 
  {
   "group": 11, 
   "name": "192.190.173.45"
  }, 
  {
   "group": 12, 
   "name": "192.204.3.75"
  }, 
  {
   "group": 13, 
   "name": "199.7.57.72"
  }, 
  {
   "group": 14, 
   "name": "208.80.154.224"
  }, 
  {
   "group": 14, 
   "name": "208.80.154.225"
  }, 
  {
   "group": 14, 
   "name": "208.80.154.234"
  }, 
  {
   "group": 14, 
   "name": "208.80.154.240"
  }, 
  {
   "group": 15, 
   "name": "216.22.25.175"
  }, 
  {
   "group": 16, 
   "name": "54.230.49.239"
  }, 
  {
   "group": 17, 
   "name": "63.245.217.36"
  }, 
  {
   "group": 18, 
   "name": "69.16.175.10"
  }, 
  {
   "group": 19, 
   "name": "69.195.141.178"
  }, 
  {
   "group": 20, 
   "name": "72.167.239.239"
  }, 
  {
   "group": 21, 
   "name": "72.21.195.198"
  }, 
  {
   "group": 22, 
   "name": "72.21.203.211"
  }, 
  {
   "group": 23, 
   "name": "72.21.214.3"
  }, 
  {
   "group": 24, 
   "name": "72.21.215.52"
  }, 
  {
   "group": 25, 
   "name": "74.125.22.82"
  }, 
  {
   "group": 26, 
   "name": "74.125.226.199"
  }, 
  {
   "group": 26, 
   "name": "74.125.226.228"
  }, 
  {
   "group": 26, 
   "name": "74.125.226.239"
  }, 
  {
   "group": 26, 
   "name": "74.125.226.242"
  }, 
  {
   "group": 26, 
   "name": "74.125.226.251"
  }, 
  {
   "group": 27, 
   "name": "75.99.175.194"
  }, 
  {
   "group": 28, 
   "name": "8.8.8.8"
  }, 
  {
   "group": 29, 
   "name": "81.169.180.37"
  }, 
  {
   "group": 30, 
   "name": "82.103.134.102"
  }, 
  {
   "group": 31, 
   "name": "82.103.140.42"
  }, 
  {
   "group": 32, 
   "name": "255.255.255.255"
  }, 
  {
   "group": 7, 
   "name": "10.25.22.255"
  }
 ]
}

















In [127]:



    


pd.DataFrame(json_prep['nodes']).head()



    


















    
Out[127]:











  
    

      
      group
      name
    

  
  
    

      0
      1
      0.0.0.0
    

    

      1
      2
      10.16.11.5
    

    

      2
      3
      10.16.92.103
    

    

      3
      3
      10.16.92.79
    

    

      4
      4
      10.2.2.2
    

  




















In [128]:



    


pd.DataFrame(json_prep['links']).head()



    


















    
Out[128]:











  
    

      
      source
      target
      value
    

  
  
    

      0
      0
      58
      157
    

    

      1
      1
      23
      24
    

    

      2
      2
      3
      105742
    

    

      3
      3
      2
      36543
    

    

      4
      4
      11
      3410
    

  




















In [129]:



    


filename_out = 'pcap_export.json'
json_out = open(filename_out,'w')
json_out.write(json_dump)
json_out.close()

Content source: austin-taylor/austin-taylor.github.io

Similar notebooks:

notebook.community | gallery | about