def flowtuple_from_raw(raw, linktype=1):
 ip = iplayer_from_raw(raw, linktype)
 if isinstance(ip, dpkt.ip.IP):
  (sip, dip) = (socket.inet_ntoa(ip.src), socket.inet_ntoa(ip.dst))
  proto = ip.p
  if ((proto == dpkt.ip.IP_PROTO_TCP) or (proto == dpkt.ip.IP_PROTO_UDP)):
   l3 = ip.data
   (sport, dport) = (l3.sport, l3.dport)
  else:
   (sport, dport) = (0, 0)
 else:
  (sip, dip, proto) = (0, 0, (-1))
  (sport, dport) = (0, 0)
 flowtuple = (sip, dip, sport, dport, proto)
 return flowtuple

def flowtuple_from_raw ( raw , linktype = 1 ) : ip = iplayer_from_raw ( raw , linktype ) if isinstance ( ip , dpkt . ip . IP ) : ( sip , dip ) = ( socket . inet_ntoa ( ip . src ) , socket . inet_ntoa ( ip . dst ) ) proto = ip . p if ( ( proto == dpkt . ip . IP_PROTO_TCP ) or ( proto == dpkt . ip . IP_PROTO_UDP ) ) : l3 = ip . data ( sport , dport ) = ( l3 . sport , l3 . dport ) else : ( sport , dport ) = ( 0 , 0 ) else : ( sip , dip , proto ) = ( 0 , 0 , ( - 1 ) ) ( sport , dport ) = ( 0 , 0 ) flowtuple = ( sip , dip , sport , dport , proto ) return flowtuple
parse a packet from a pcap just enough to gain a flow description tuple .