IDS: cicflowmeter.py

Installation

git clone https://github.com/datthinh1801/cicflowmeter.git
cd cicflowmeter
python3 setup.py install

Usage

usage: cicflowmeter [-h] (-i INPUT_INTERFACE | -f INPUT_FILE) [-c] [-u URL_MODEL] output

positional arguments:

 output                output file name (in flow mode) or directory (in sequence mode)

optional arguments:

 -h, --help            show this help message and exit
 -i INPUT_INTERFACE    capture online data from INPUT_INTERFACE
 -f INPUT_FILE         capture offline data from INPUT_FILE
 -c, --csv, --flow     output flows as csv

Sniff packets real-time from interface to flow csv: (need root permission)

cicflowmeter -i enp0s3 -c flows.csv

Convert pcap file to flow csv:

tcpdump -i enp0s3 -s 65535 -w hasil-capture.pcap
cicflowmeter -f hasil-capture.pcap -c flows.csv

Referensi

• https://pypi.org/project/cicflowmeter/