packets

gistfile1.txt

require('dotenv').config()

const tlsClientHello = require('is-tls-client-hello')
const sni = require('sni')
var hash = require('object-hash');

const AWS = require('aws-sdk');
AWS.config.update({
  accessKeyId: process.env.ACCESS_KEY_ID,
  secretAccessKey: process.env.SECRET_ACCESS_KEY,
  region: 'us-east-1'
});

const firehoser = require('firehoser');
let maxDelay = 2000;
let maxQueued = 100;
let firehose = new firehoser.JSONDeliveryStream('iotpackets',
	maxDelay,
	maxQueued
);

const pcap = require('pcap')
const session = pcap.createSession('en0')
session.on('packet', (raw) => {
	const packet = pcap.decode.packet(raw)
	try {
		const parsed = parse(packet, raw)
		if(parsed) {
			const data = {...parsed, id: hash(parsed)}
			firehose.putRecord(data)
				.then(() => {
					console.log(data)
				})
				.catch((err) => {
					console.log(err)
				})
				;
		}
	} catch (err) {
		console.log(packet)
		console.log(err)
	}
})

const parse = (packet) => {
	const ts = packet.pcap_header.tv_sec
	const eth = packet.payload
	const ip = eth.payload
	if (!ip) {
		return false
	}

	const tcp = ip.payload
	
	if (ip.protocolName === 'Unknown' || typeof ip.payload === 'undefined') {
		return false
	}

	const shost = eth.shost.addr.map((e) => {
		const byte = e.toString(16)
		return byte.length === 1 ? `0${byte}` : byte
	}).join(':').toUpperCase()
	const dhost = eth.dhost.addr.map((e) => {
		const byte = e.toString(16)
		return byte.length === 1 ? `0${byte}` : byte
	}).join(':').toUpperCase()
	const src = ip.saddr.addr.join('.')
	const dst = ip.daddr.addr.join('.')

    if (tcp.sport === 8443 ||
        tcp.sport === 443 ||
        tcp.dport === 443 ||
        tcp.dport === 8443) {
      if (tcp.data) {
        if (tlsClientHello(tcp.data)) {
        	const url = sni(tcp.data)
        	// TODO: Need to change this if aws firehose location changes
        	if (url.indexOf('firehose.us-east-1.amazonaws.com') > -1 ){
        		return false
        	}
          return {ts: ts, shost: shost , dhost: dhost, saddr: src, daddr: dst, sport: tcp.sport, dport: tcp.dport, type: 'https', payload: url}
        }
      }
      return false
	}

    if (!tcp.data) {
      return false
    }

    const r = tcp.data.toString('utf-8')
    if (r.indexOf('Content-Length') === -1 &&
        r.indexOf('Host') === -1 &&
        r.indexOf('Content-Type') === -1) {
      return false
    }

    try {
      return { ts: ts, shost: shost, dhost: dhost, saddr: src, daddr: dst, sport: tcp.sport, dport: tcp.dport, type: 'http', payload: r }
    } catch (err) {
      this.error(err)
      return false
	}
}