Search code examples
pythonwiresharkpacketscapy

Whole packet length Scapy

I am capturing WiFi traffic with tcpdump using the parameter -s 100 (which means I am only capturing the headers of the packets).

When I load the .pcap file and process it with Scapy I do:

pkts = rdpcap(pcapfile)
totalbytes = 0
for pkt in pkts:
    totalbytes += len(pkt)

However, as I am truncating the capture, doing len(pkt) will not give me the whole packet length (frame length), it will give me the captured packet length. How can I get the real packet length?

Extra: as I have done in some occasions before, I open the pcap file in wireshark and search for the hex values of interest. But in this case (frame.len) will show the value I am looking for, but I can't find the way wireshark obtains this real packet length without having the whole packet captured.

Solution

  • The rdpcap function uses the PcapReader class for reading packets. Unfortunately this class discards the information you are looking for in the read_packet method, even though it is to be found in the pcap file. So you have to use the RawPcapReader directly.

    totalbytes = 0
for pkt, (sec, usec, wirelen) in RawPcapReader(pcapfile):
    totalbytes += wirelen