Nfstream：一款易于扩展的网络数据分析框架

from nfstream import NFStreamer       my_awesome_streamer = NFStreamer(source="facebook.pcap") # or network interface (source="eth0")       for flow in my_awesome_streamer:
           print(flow)  # print it, append to pandas Dataframe or whatever you want !
    NFEntry(            id=0,
            first_seen=1472393122365,
            last_seen=1472393123665,
            version=4,            src_port=52066,            dst_port=443,
            protocol=6,            vlan_id=0,            src_ip='192.168.43.18',            dst_ip='66.220.156.68',
            total_packets=19,
            total_bytes=5745,
            duration=1300,            src2dst_packets=9,            src2dst_bytes=1345,
            dst2src_packets=10,            dst2src_bytes=4400,
            expiration_id=0,
            master_protocol=91,
            app_protocol=119,
            application_name='TLS.Facebook',
            category_name='SocialNetwork',
            client_info='facebook.com',            server_info='*.facebook.com',            j3a_client='bfcc1a3891601edb4f137ab7ab25b840',
            j3a_server='2d1e***17ece335c24904f516ad5da12'    )
将pcap转换为Pandas DataFrame：
import pandas as pd
    streamer_awesome = NFStreamer(source='devil.pcap')
    data = []
    for flow in streamer_awesome:       data.append(flow.to_namedtuple())
    my_df = pd.DataFrame(data=data)
    my_df.head(5) # Enjoy!

from nfstream import NFPlugin    class my_awesome_plugin(NFPlugin):        def on_update(self, obs, entry):            if obs.length >= 666:
                entry.my_awesome_plugin = 1    streamer_awesome = NFStreamer(source='devil.pcap', plugins=[my_awesome_plugin()])    for flow in streamer_awesome:       print(flow.my_awesome_plugin) # see your dynamically created metric in generated flows