tcpdump filter by opt. src + dest ip, & disp freqs per proto

#!/usr/bin/python
import sys
import re
import os.path

USAGE = 'Usage: {} [src_ip [dest_ip]] file'.format(sys.argv[0])

"""Basically, this script takes a csv-like file, and gives a count of how many adjacent (e.g. line 44 and line 45) duplicate lines it finds.
Additionally, it will filter based on optional src_ip and dest_ip arguments."""

IP_PATTERN = re.compile(r'^(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.'
                       +r'(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.'
                       +r'(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.'
                       +r'(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])$')

def check_ips(*ip_name_pairs):
    # Check for valid ips. If not valid, error and exit
    for ip, name in ip_name_pairs:
        if IP_PATTERN.match(ip) is None:
            # print ip + ' is not a valid IPv4 address'
            print 'Invalid ' + name + ' IP'
            sys.exit()

filename = os.path.abspath(sys.argv[-1])

def get_packets(filename):
    # if a valid file, return unfiltered lines
    # else, error and exit
    if not os.path. exists(filename) or not os.path.isfile(filename):
        print 'File ' + sys.argv[-1] + ' does not exist'
        sys.exit()
    with open(filename) as f:
        return [','.join(line.strip().replace('"', '').split(',')[2:5]) for line in f]


# Begin filtering packets based on sys.argv
if len(sys.argv) == 2:
    lines = get_packets(filename)
elif len(sys.argv) == 3:
    check_ips((sys.argv[1], 'Source'))
    lines = [line for line in get_packets(filename) if sys.argv[1] in line.split(',')[0]]
elif len(sys.argv) == 4 and sys.argv[2] == '-s':
    check_ips((sys.argv[2], 'Source'))
    lines = [line for line in get_packets(filename) if sys.argv[2] in line.split(',')[0]]
elif len(sys.argv) == 4 and sys.argv[2] == '-d':
    check_ips((sys.argv[2], 'Destination'))
    lines = [line for line in get_packets(filename) if sys.argv[2] in line.split(',')[1]]
elif len(sys.argv) == 4:
    check_ips((sys.argv[1], 'Source'), (sys.argv[2], 'Destination'))
    lines = [line for line in get_packets(filename) if sys.argv[1] in line.split(',')[0] and sys.argv[2] in line.split(',')[1]]
else:
    # user must have entered either no arguments, or more than 3. Error and exit
    print USAGE
    sys.exit()

# Now actually count the frequencies
counts = {}
for line in lines:
    if line in counts:
        counts[line] += 1
    else:
        counts[line] = 1

# Print output header
print "%20s %20s %15s %15s" % ("Source IP", "Destination IP", "Protocol", "Count")

last = ['', '', '']
for line in sorted(counts.keys()):
    line = line.split(',')
    if [last[0], last[1]] == line[0:2]:
         # if same src ip and dest ip as the last line,
         # then only print the protocols, and their frequencies
     print ('{:>57} {:>15}'
        .format(line[2], counts[','.join(line)]))
    elif last[0] == line[0]:
         # if only same src ip as the last line,
         # then start a new line, and print dest ip, protocols, and their frequencies
     print ('\n{:>41} {:>15} {:>15}'
        .format(line[1], line[2], counts[','.join(line)]))
    else:
         # if both src ip and dest ip are different from the line before,
         # then begin a new line, and print everything
         print ('\n{:>20} {:>20} {:>15} {count:>15}'
            .format(*line, count = counts[','.join(line)]))
    last = line

# print the total count
print '\n{:<40} Total: {:>14}'.format('', sum(counts.values()))