#!/usr/bin/env python

from scapy.all import *

def somefilter(pcapfile):
    flows = dict()
    for p in PcapReader(pcapfile):
        if IP in p:
            src = p[IP].src
            dst = p[IP].dst
    
            if (src,dst) in flows:
                flows[(src,dst)] +=1
            else:
                flows[(src,dst)] = 1
    
    for flow,cnt in flows.items():
        if cnt >= 200:
            print 'tshark -r '+pcapfile+' -w "flow_'+flow[0]+'_'+flow[1]+'.pcap" -F pcap ' \
                   + '\'ip.src == '+flow[0]+' and ip.dst == '+flow[1]+'\''
            print 'tshark -n -r "flow_'+flow[0]+'_'+flow[1]+'.pcap" -Eheader=y -Eseparator=, -Equote=d -Tfields '\
                   + '-e frame.number -e _ws.col.Time -e ip.src -e ip.dst -e _ws.col.Protocol -e frame.len '\
                   + '-e _ws.col.Info -e _ws.col.dscp -e _ws.col.ipid -e _ws.col.cs -e _ws.col.srcport '\
                   + '-e _ws.col.dstport -e _ws.col.proto > flow_'+flow[0]+'_'+flow[1]+'.csv'

    
if __name__ == "__main__":
	somefilter("team15_ex22.pcap")