Filter out specific IP addresses in Python from a Wireshark capture

Viewed 423

I'm modifying (https://github.com/crclayton/streamer-locator/blob/master/python-wireshark-geolocate.py) a Python script for capturing IP's and Geolocating in Omegle. However, I use Discord in the same time, so my output gets flooded by other IP's and then I only get locations from United States, California, Mountain View.

from geolite2 import geolite2
import socket, subprocess 

cmd = r"C:\Program Files\Wireshark\tshark.exe -i ethernet"

process = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
my_ip = socket.gethostbyname(socket.gethostname())
reader = geolite2.reader()

def get_ip_location(ip):
    location = reader.get(ip)
    
    try:
        country = location["country"]["names"]["en"]
    except:
        country = "Unknown"

    try:
        subdivision = location["subdivisions"][0]["names"]["en"]
    except:
        subdivision = "Unknown"    

    try:
        city = location["city"]["names"]["en"]
    except:
        city = "Unknown"
    
    return country, subdivision, city


for line in iter(process.stdout.readline, b""):
    columns = str(line).split(" ")

    if "SKYPE" in columns or "UDP" in columns:
        
        if "->" in columns:
            src_ip = columns[columns.index("->") - 1]
        elif "\\xe2\\x86\\x92" in columns:
            src_ip = columns[columns.index("\\xe2\\x86\\x92") - 1]
        else:
            continue
            
        if src_ip == my_ip:
            continue

        try:
            country, sub, city = get_ip_location(src_ip)
            print(">>> " + country + ", " + sub + ", " + city)
        except:
            try:
                real_ip = socket.gethostbyname(src_ip)
                country, sub, city = get_ip_location(real_ip)
                print(">>> " + country + ", " + sub + ", " + city)
            except:
                print("Not found")

This is the current code, and I would like to know how can I filter the Discord/Google IPs from the Omegle ones.

These are the IP's I got on Wireshark that might be causing trouble(all from servers, not people)

  • 213.163.87.50
  • 35.214.192.94
  • 162.159.128.235
  • 40.77.226.250
  • 162.159.134.234

I am pretty new to Python so I apologize if this is a stupid question. Also, this is my first time asking on StackOverflow so I'm not sure if this is all of the info needed.

0 Answers
Related