import impacket.ImpactDecoder, impacket.ImpactPacket
# Domain names for cloud service providers, whose traces we want to pull out.
-DOMAINS = ['.amazon.com', '.core.windows.net']
+DOMAINS = ['.amazon.com', '.amazonaws.com', '.core.windows.net',
+ '204.246.162.', '87.238.86.']
# The collection of flows we've seen. The value associated with each flow is a
# sequence number indicating in what order we saw the flows in the trace.
matches = False
for d in DOMAINS:
if name.endswith(d): matches = True
- if not matches: continue
+ if name.startswith(d): matches = True
+ if not matches:
+ print "Host", name, "not recognized, skipping"
+ continue
filter = "tcp and (host %s and host %s) and (port %d and port %d)" \
% (src, dst, sport, dport)