Satori Rewrite?

Ok, it has been 3 years since the last time I posted on rewriting Satori.....

I sat down Friday after work with pypacker.  I put an hour or two into getting it to read packets with some example code and parse through tcp packets to at least get my TCP fingerprinting under way.  I bounced a question off of the developer (one earlier in the week when I was hoping to start and then again once I finally did).  He was helpful in both cases and by the end of Saturday I had code in place that properly dissects TCP packets.  I have 2 pieces to fix, one which has always been my nemesis, bit shifting, never really got it in my head how that works 15 years ago when I wrote Satori in Delphi and now that I rarely program this type of stuff anymore, no better off with python.   The difference in 2018 though is I'm not writing the protocol dissectors anymore!

Pypacker isn't really decided per se for what I'm using it for, it is really more for making your own packets, but it has the ability to decode them as well!  He already has the protocol stack built out for almost everything I need, just missing SMB.  Once I get through TCP, DHCP and a few others I'll start looking at that one, but it will be a bit down the road.

The one difference with this rewrite vs the one I claimed in 2015, 2014, 2013.....  I'm actually really interested it doing this this time.  Code will also all be open sourced this time around and project will be hosted out on something like github.

Time permitting today, I should have TCP, p0f v2 style and ettercap done.   I hope to have something in place as well to actually parse through the fingerprint files and spit out a guess at the OS.  While I'd prefer to do DHCP as my first one, as that was where I really enjoyed this the most, TCP seems like the most useful.  Once I get this done I'll look at p0fv3 that came out in the 2014 time frame as I was really winding down my work in this field.

Anyway, if you are doing any type of python and network type stuff, I highly recommend you check out pypacker.   I had tried doing this before with scapy, dpkt and a few others, but they were all a bit slow on convoluted for me and didn't have enough of the protocols already built out.  Or maybe they really did and I just wasn't motivated enough, can't really say. 

Its fun to be working on this project again after this long break.  Once I get it moving along, fingerprint files will be updated again as well.

Initial output:
192.168.25.128:36526 -> 216.58.217.34:443
 Flags: S ,Fingerprint: 29200:64:4096:60:M1460,S,T,N,W7:.
216.58.217.34:443 -> 192.168.25.128:36526
 Flags: SA ,Fingerprint: 64240:128:0:44:M1460:A

The 4096 part is due to bad bit shifting on my part to read the don't fragment bit (reading 1 bit out of 16 is so much fun).  I did a kludge elsewhere in the code, but now that i remember about bitshifting, may have to go back and rewrite that.  But 95% of the way there on TCP at this point!