def _l7_analysis(self, packet):
        """Analyzes application level of pcap.

        :param packet: Single packet.
        """
        if packet.dns:
            if packet.dns.qr == 0:
                # dns question
                for question in packet.dns.questions:
                    self._dns_questions.add(question)

            # report anomaly
            if (
                packet.dns.question_count > 499
                or packet.dns.answer_count > 499
                or packet.dns.authority_count > 499
                or packet.dns.additional_count > 499
            ):
                name = 'dns_header_many_records'
                description = ('Sample sends DNS header with either big '
                               'number of questions, answers, authorities '
                               'or additionals.')
                data = {
                    'question_count': packet.dns.question_count,
                    'answer_count': packet.dns.answer_count,
                    'authority_count': packet.dns.authority_count,
                    'additional_count': packet.dns.additional_count
                }

                anomaly = Anomaly(name, description, data)
                self._anomalies.append(anomaly.to_dict())

        if packet.http:
            if packet.http.is_request:
                # http request
                request = {
                    'method': packet.http.request_method,
                    'uri': packet.http.request_uri,
                    'version': packet.http.version,
                    'headers': {}
                }
                # headers
                for key in packet.http.headers:
                    request['headers'][key] = packet.http.headers[key]

                self._http_requests.append(request)

        if packet.irc:
            for message in packet.irc.messages:
                # irc messages
                str_message = message.command
                for param in message.params:
                    str_message += ' ' + param
                str_message += ' ' + message.trailing
                str_message = str_message.strip()
                if str_message != '':
                    self._irc_messages.append(str_message)

        if packet.telnet:
            if len(packet.telnet.data.strip()) != 0:
                self._telnet_data.append(packet.telnet.data)
Analyzes application level of pcap.

        :param packet: Single packet.
        
lisa/analysis/network_analysis.py