Search code examples
pythontsharkhexdumppyshark

Is it possible to access the hexdump of a packet in PyShark?


I am using pyshark to open and parse pcap files. Currently I've been able to access the packet fields. But I cannot seem to find a way to access the hexdump value of each packet. Is there any way to do that?


Solution

  • According to the homepage of PyShark:

    [PyShark] doesn't actually parse any packets, it simply uses tshark's (wireshark command-line utility) ability to export XMLs to use its parsing.

    The XML exported by tshark is either PSML (Packet Summary Markup Language) or PDML (Packet Details Markup Language) and neither of these format store the full hexadecimal dump of packets.

    After digging into the source code and considering the point above, I can say that the feature you are looking for is not implemented in PyShark.