在python中访问/迭代复杂字典对象时出现问题

Question

所以我想以我是python的新手。。。我正在尝试访问一个复杂对象的值。当在for循环中使用for循环时，我会不断出现以下错误。。。

TypeError:对象不支持分配

或

心房错误："str"对象没有属性"syn">

。。。我认为这源于对第#1节connect(packet.s中的scan.results对象的赋值或类的构造不当。在方法connect_scan_exist的#2区域中，我们可以看到访问value.flags.XX时出现问题。我认为这是由于我构建字典中使用的支持类对象的方式造成的。

方法

# determine if a connect scan takes place
def connect_scan_exist(packets):
s = scan()

#1。抓取所有TCP同步

for key, value in packets.items():
# add tcp packets with syn that are not already entered
if ( value.packet_type == 'TCP'
and value.source_ip 
and value.destination_ip 
and value.destination_port 
and value.flags.syn
and value.flags.ack == False
and value.flags.rst == False
and value.flags.fin == False):
s.results[str(value.source_ip) + '|'+ str(value.destination_ip) + '|' + str(value.destination_port)] = connect(packet.source_ip, packet.destination_ip, packet.destination_port, True, packet.timestamp, None, None, None, None)

#2。遍历所有TCP syn，寻找匹配的syn/ack

for skey, svalue in s.results.items():
for key, value in packets.items():
# print(len(value.flags))
if ( value.destination_ip == svalue.source_ip
and value.source_ip == svalue.destination_ip
and value.source_port == svalue.destination_port
# and value.scan_categories.is_null_scan ## <---this one works 
and value.flags.syn
and value.flags.ack
and value.flags.rst == False
and value.flags.fin == False
and value.timestamp > svalue.source_syn_time
and svalue.destination_synack is None):
# update scan result with cooresponding syn/ack
s.results[str(value.source_ip) + '|' + 
str(value.destination_ip) + '|' + 
str(value.destination_port)].destination_synack = True
s.results[str(value.source_ip) + '|'+ 
str(value.destination_ip) + '|' + 
str(value.destination_port)].destination_synack_time = value.timestamp

#3。遍历所有TCP syn以查找匹配的ack

for skey, svalue in s.results.items():
for key, value in packets.items():
if ( value.source_ip == svalue.source_ip
and value.destination_ip == svalue.destination_ip
and value.destination_port == svalue.destination_port
and value.flags.syn == False 
and value.flags.ack
and value.flags.rst == False
and value.flags.fin == False
and value.timestamp > svalue.source_synack_time
and svalue.source_ack is None):
# update scan result with cooresponding syn/ack
s.results[str(value.source_ip) + '|' + 
str(value.destination_ip) + '|' + 
str(value.destination_port)].source_ack = True
s.results[str(value.source_ip) + '|'+ 
str(value.destination_ip) + '|' + 
str(value.destination_port)].source_ack_time = value.timestamp
# 4. remove all incomplete ? maybe 
# 5. analysis
s.scanfound = (True if (len(s.results) > 10) else False)
s.description = 'Very primative observation. Found more than 10 entries starting with TCP Syn'
return s

类别

# define connect scan class
class connect(object):
def __init__(self, src_ip=None, dst_ip=None, dst_port=None, src_syn=None, src_syn_time=None, dst_synack=None, dst_synack_time=None, 
src_ack=None, src_ack_time=None):
self.source_ip = src_ip
self.destination_ip = dst_ip
self.destination_port = dst_port
self.source_syn = src_syn
self.source_syn_time = src_syn_time
self.destination_synack = dst_synack
self.destination_synack_time = dst_synack_time
self.source_ack = src_ack
self.source_ack_time = src_ack_time
# define half open scan class
class scan(object):
def __init__(self, scan=False, desc=None):
self.scanfound = scan
self.description = desc
self.results = dict()
# define generic packet class
class generic_packet(object): 
def __init__(self, packet_type=None, time=None, src_mac=None, src=None, src_port=None, dst_mac=None, dst=None, 
dst_port=None, seq=None, ack=None, flags=None, options=None, data=None):
self.packet_type = packet_type
self.timestamp = time
self.scan_categories = scan_type()
self.source_mac = src_mac
self.source_ip = src
self.source_port = src_port
self.destination_mac = dst_mac
self.destination_ip = dst
self.destination_port = dst_port
self.sequence = seq
self.acknowledge = ack
self.flags = flags # tcp_flags(flags)
self.options = options
self.data = data

Answer 1

运行代码时，packets的某些元素似乎是str，而不是tcp_flags。

您可以跳过这些元素添加此行186:

if not isinstance(value.flags, tcp_flags):
continue

或者，由于数据包似乎包含TCP和UDP，您可以在步骤#2和#3中检查value.packet_type == 'TCP'。程序在具有generic_packet.flags = None的UDP数据包上失败，因此对象的作用域中没有syn、ack等。

# determine if a connect scan takes place
def connect_scan_exist(packets):
s = scan()
# 1. grab all TCP syn
for key, value in packets.items():
# add tcp packets with syn that are not already entered
if ( value.packet_type == 'TCP'
and value.source_ip 
and value.destination_ip 
and value.destination_port 
and value.flags.syn
and value.flags.ack == False
and value.flags.rst == False
and value.flags.fin == False):
s.results[str(value.source_ip) + '|'+ str(value.destination_ip) + '|' + str(value.destination_port)] = connect(packet.source_ip, packet.destination_ip, packet.destination_port, True, packet.timestamp, None, None, None, None)
# 2. iterate over all TCP syn looking for matching syn/ack
for skey, svalue in s.results.items():
for key, value in packets.items():
# print(len(value.flags))
if (value.packet_type == 'TCP' 
and value.destination_ip == svalue.source_ip
and value.source_ip == svalue.destination_ip
and value.source_port == svalue.destination_port
# and value.scan_categories.is_null_scan ## <---this one works 
and value.flags.syn
and value.flags.ack
and value.flags.rst == False
and value.flags.fin == False
and value.timestamp > svalue.source_syn_time
and svalue.destination_synack is None):
# update scan result with cooresponding syn/ack
s.results[str(value.source_ip) + '|' + 
str(value.destination_ip) + '|' + 
str(value.destination_port)].destination_synack = True
s.results[str(value.source_ip) + '|'+ 
str(value.destination_ip) + '|' + 
str(value.destination_port)].destination_synack_time = value.timestamp
# 3. iterate over all TCP syn looking for matching ack
for skey, svalue in s.results.items():
for key, value in packets.items():
if ( **value.packet_type == 'TCP'**
and value.source_ip == svalue.source_ip
and value.destination_ip == svalue.destination_ip
and value.destination_port == svalue.destination_port
and value.flags.syn == False 
and value.flags.ack
and value.flags.rst == False
and value.flags.fin == False
and value.timestamp > svalue.source_synack_time
and svalue.source_ack is None):
# update scan result with cooresponding syn/ack
s.results[str(value.source_ip) + '|' + 
str(value.destination_ip) + '|' + 
str(value.destination_port)].source_ack = True
s.results[str(value.source_ip) + '|'+ 
str(value.destination_ip) + '|' + 
str(value.destination_port)].source_ack_time = value.timestamp
# 4. remove all incomplete ? maybe 
# 5. analysis
s.scanfound = (True if (len(s.results) > 10) else False)
s.description = 'Very primative observation. Found more than 10 entries starting with TCP Syn'
return s