dm secu

securite/dm/pcap_analyzer/src/main.rs

@@ -1,4 +1,4 @@
-use std::{error::Error, path::PathBuf};
+use std::{collections::HashMap, error::Error, ops::AddAssign, path::PathBuf};
 
 use clap::{Parser, Subcommand};
 use etherparse::{NetSlice, SlicedPacket};
@@ -23,6 +23,8 @@ fn main() -> Result<(), Box<dyn Error>> {
 			let mut errs = 0;
 			let mut first_timestamp = None;
 			let mut last_timestamp = None;
+			let mut protocols = HashMap::new();
+
 			while let Ok(packet) = pcap.next_packet() {
 				total += 1;
 
@@ -36,22 +38,31 @@ fn main() -> Result<(), Box<dyn Error>> {
 					continue;
 				};
 
-				if let Some(NetSlice::Ipv4(_)) = packet.net {
+				if let Some(NetSlice::Ipv4(ipv4)) = packet.net {
+					let protocol = ipv4.header().protocol();
+					protocols.entry(protocol).or_insert(0).add_assign(1);
 					total_ipv4 += 1;
 				}
 			}
 
-			println!("Count:           {total: >20}");
-			println!("Count IPv4:      {total_ipv4: >20}");
+			println!("Count:           {total: >14}");
+			println!("Count IPv4:      {total_ipv4: >14}");
 			let non_ipv4 = total - total_ipv4;
-			println!("non-IPv4 count:  {non_ipv4: >20}");
+			println!("non-IPv4 count:  {non_ipv4: >14}");
 			let first_timestamp = first_timestamp.map(tv_to_sec).unwrap_or_default();
-			println!("First timestamp: {first_timestamp: >20.2}");
+			println!("First timestamp: {first_timestamp: >14.2}");
 			let last_timestamp = last_timestamp.map(tv_to_sec).unwrap_or_default();
-			println!("Last timestamp:  {last_timestamp: >20.2}");
+			println!("Last timestamp:  {last_timestamp: >14.2}");
 			let avg_packet = (last_timestamp - first_timestamp) / total as f64;
-			println!("Avg packet rate: {avg_packet: >20.4}");
-			println!("Errors:          {errs: >20}");
+			println!("Avg packet rate: {avg_packet: >14.4}");
+			println!("Errors:          {errs: >14}");
+
+			let mut protocols: Vec<_> = protocols.into_iter().collect();
+			protocols.sort_by_key(|(_, count)| *count);
+			println!("Main Protocols:");
+			for (num, count) in protocols.into_iter().take(5) {
+				println!("- {num:?} {count: >14}");
+			}
 		}
 	}