mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
38 lines
1.8 KiB
Python
38 lines
1.8 KiB
Python
#!/usr/bin/env python3
|
|
"""PCAP Forensic Analyzer - Analyzes packet captures for forensic investigation."""
|
|
import json, os, sys
|
|
from collections import defaultdict, Counter
|
|
from datetime import datetime
|
|
try:
|
|
from scapy.all import rdpcap, IP, TCP, UDP, DNS, DNSQR
|
|
except ImportError:
|
|
print("Install scapy: pip install scapy"); sys.exit(1)
|
|
|
|
def analyze_pcap(pcap_path: str, output_dir: str) -> str:
|
|
os.makedirs(output_dir, exist_ok=True)
|
|
packets = rdpcap(pcap_path)
|
|
convos = defaultdict(lambda: {"pkts": 0, "bytes": 0})
|
|
dns_queries = []
|
|
protocols = Counter()
|
|
for pkt in packets:
|
|
if IP in pkt:
|
|
key = tuple(sorted([pkt[IP].src, pkt[IP].dst]))
|
|
convos[key]["pkts"] += 1; convos[key]["bytes"] += len(pkt)
|
|
if TCP in pkt: protocols[f"TCP/{pkt[TCP].dport}"] += 1
|
|
elif UDP in pkt: protocols[f"UDP/{pkt[UDP].dport}"] += 1
|
|
if DNS in pkt and pkt[DNS].qr == 0 and DNSQR in pkt:
|
|
dns_queries.append({"query": pkt[DNSQR].qname.decode(errors="replace").rstrip("."),
|
|
"src": pkt[IP].src if IP in pkt else ""})
|
|
top_convos = sorted([{"src": k[0], "dst": k[1], **v} for k, v in convos.items()],
|
|
key=lambda x: x["bytes"], reverse=True)[:50]
|
|
report = {"total_packets": len(packets), "conversations": top_convos,
|
|
"dns_queries": dns_queries[:200], "protocols": dict(protocols.most_common(30))}
|
|
out = os.path.join(output_dir, "pcap_analysis.json")
|
|
with open(out, "w") as f: json.dump(report, f, indent=2)
|
|
print(f"[*] Packets:{len(packets)} Convos:{len(convos)} DNS:{len(dns_queries)}")
|
|
return out
|
|
|
|
if __name__ == "__main__":
|
|
if len(sys.argv) < 3: print("Usage: process.py <pcap> <output>"); sys.exit(1)
|
|
analyze_pcap(sys.argv[1], sys.argv[2])
|