TLV Finder algorithm

python3 tlv_finder.py pcaps/only_eigrp_full.pcap

TLV Finder Evaluation

Command to evaluate the TLV finder from TLVs stored in a file

python3 evaluation_tlv.py pcaps/only_eigrp_full.pcap results/results_eigrp.txt eigrp

Argument descriptions:

• pcaps/only_eigrp_full.pcap: The pcap file to evaluate
• results/results_eigrp.txt: The file containing the expected TLV results
• eigrp: The protocol to evaluate (e.g., eigrp, isis...)

Command to evaluate the TLV finder from the output of the TLV finder

python3 tlv_finder.py pcaps/only_eigrp_full.pcap | python3 evaluation_tlv.py pcaps/only_eigrp_full.pcap eigrp

Use pypy to speed up the evaluation:

pypy3 tlv_finder.py pcaps/only_eigrp_full.pcap | pypy3 evaluation_tlv.py pcaps/only_eigrp_full.pcap eigrp

But remove the import: import matplotlib.pyplot as plt

Command with full workflow

python3 binaryinferno/blackboard.py --pcap pcaps/babel_big_1.pcap --maxpkts 1000 --headeronly | pypy3 tlv_finder.py pcaps/babel_big_1.pcap --read-length-stdin | python3 evaluation_tlv.py pcaps/babel_big_1.pcap babel

Usage example for binaryinferno with the Babel pcap TLV finder

 python3 binaryinferno/blackboard.py --pcap pcaps/babel_big_1.pcap --maxpkts 100 --headeronly | python3 /home/martin/Documents/Thesis/tlv_finder/tlv_finder.py /home/martin/Documents/Thesis/tlv_finder/pcaps/babel_big_1.pcap --read-length-stdin