<commit_before>#!/usr/bin/env python
import sys
import threading
import time
from scapy.all import *

# Mare Detector
def main():
  # Queue to store the last n packets from the wire/air (last ~100 packets)
  packets = []
  print("-" * 46)
  print("Mare Detector: Watching for suspicious traffic.." )
  print("-" * 46)

  # Check for args and set interface
  if (len(sys.argv) != 2):
    printMsg("No interface specified. Exiting.")
    sys.exit()
  interface = sys.argv[1]
  printMsg("Selected interface: %s" % interface)

  # Start the monitor thread to constantly search the queue for IDS items
  monitorThread = threading.Thread(target=quantum_test_thread, args=("monitor-thread", packets)).start()

  # Start sniffing with callback dumping packets into a queue
  sniff(iface=interface, prn=lambda packet: packets.append(packet), filter="tcp", store=0)

# Test to see whether a packet with dup SEQ numbers has been recieved recently
def quantum_test_thread(name, packets):
  logfile = "%s-mare-detect-log.pcap" % time.time()

  while (True):
    print(len(packets))

    # Test packets for duplicate seq with varied payloads
    for testPacket in packets:
      for packet in packets:
        if (testPacket[TCP].seq == packet[TCP].seq): # seq match
          #if (testPacket[IP].ttl != packet[IP].ttl): ## ttl mismatch
          printMsg("Printing two packets with same ttl and seq number:")
          wrpcap(logfile, (testPacket, packet))

    # Pop/trim old packets from queue
    if (len(packets) > 100):
      while (len(packets) > 100):
        packets.pop()
    time.sleep(5)

# Print out individual debug messages
def printMsg(msg):<commit_msg>Actually check for quantum now<commit_after>#!/usr/bin/env python
import os
import sys
import threading
import time
from scapy.all import *

# Mare Detector
def main():
  mtx = threading.Lock()
  packets = [{}, {}] # Dict of 5 seconds of packets, List for shallow-copy in monitor_thread

  print("-" * 48)
  print("Mare Detector: Watching for suspicious traffic.." )
  print("-" * 48)

  # Check for args and set interface
  if (len(sys.argv) != 2):
    printMsg("No interface specified. Exiting.")
    sys.exit()
  interface = sys.argv[1]
  printMsg("Selected interface: %s" % interface)

  # Make logging directory
  os.mkdir("logs")

  # Start the monitor thread to constantly search the queue for IDS items
  monitorThread = threading.Thread(target=monitor_thread, args=("monitor-thread", mtx, packets)).start()

  def prn(packet):
    key = "%s" % packet["<KEY>
    mtx.acquire()
    packets[0].setdefault(key, []).append(packet)
    mtx.release()

  # Start sniffing with callback dumping packets into a dict (md5(TCP.seq) => packet)
  sniff(iface=interface, prn=prn, filter="tcp src port 80", store=0)

# Test to see whether a packet with dup SEQ numbers has been recieved recently
def monitor_thread(name, mtx, packets):

  while (True):
    time.sleep(5)
    printMsg("Rate: %s pkt/s, (Current 5s: %s, Last 5s: %s)" % ((len(packets[0]) + len(packets[1])/10), len(packets[0]), len(packets[1])))

    # Last 5 seconds
    mergedPackets = packets[1]

    # Lock to get current 5 second snippet of packets
    with mtx:
      packets[1] = packets[0]
      packets[0] = {}

    # Make a copy and merge the snippets together
    mergedPackets.update(packets[1])

    # Packets from the current iteration with duplicate SEQ numbers
    duplicateSEQ = []
    for key in mergedPackets:

      # Find duplicate SEQ numbers
      if (len(mergedPackets[key]) > 1):
        for packet in mergedPackets[key]:
          if packet[IP].len > 52: # min size
            duplicateSEQ.append(packet)

        # Check if payload size or TTL suddenly change
        sizeAndTTL = ()
        first = True
        quantum = False
        for packet in duplicateSEQ:
          if first:
            first = False
            sizeAndTTL = (packet[IP].len, packet[IP].ttl)
          else:
            if (sizeAndTTL != (packet[IP].len, packet[IP].ttl)):
              quantum = True
              print("Size: %s, TTL: %s" % (sizeAndTTL[0], sizeAndTTL[1]))

        # If yes, write the packets to PCAP
        if quantum:
          quantum = False
          printMsg("Possible quantum insert deteced. Written to PCAP.")
          wrpcap("logs/%s-mare-detector.pcap" % time.time(), duplicateSEQ)

# Print out individual debug messages
def printMsg(msg):
{'fraction_non_alphanumeric': 0.11850501367365543, 'fraction_numerical': 0.011394712853236098, 'mean_word_length': 3.1288805268109123, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4776526', 'n_tokens_mistral': 1392, 'n_tokens_neox': 1337, 'n_words': 441}