Parsing a pcap file in python -
this question has answer here:
- pcap python library? [closed] 4 answers
i trying parse through pcap file in python. goal able pull out type of tcp or udp file , time start/end. have advice in packages might useful use , documentation them or advice in general on writing it?
i use python-dpkt. here documentation: http://www.commercialventvac.com/dpkt.html
this know how though sorry.
#!/usr/local/bin/python2.7 import dpkt counter=0 ipcounter=0 tcpcounter=0 udpcounter=0 filename='sampledata.pcap' ts, pkt in dpkt.pcap.reader(open(filename,'r')): counter+=1 eth=dpkt.ethernet.ethernet(pkt) if eth.type!=dpkt.ethernet.eth_type_ip: continue ip=eth.data ipcounter+=1 if ip.p==dpkt.ip.ip_proto_tcp: tcpcounter+=1 if ip.p==dpkt.ip.ip_proto_udp: udpcounter+=1 print "total number of packets in pcap file: ", counter print "total number of ip packets: ", ipcounter print "total number of tcp packets: ", tcpcounter print "total number of udp packets: ", udpcounter
Comments
Post a Comment