Search code examples
pythonparsingpcappacketsdpkt

Parsing a PCAP File in python

I am trying to parse a Pcap file in python. When i run this code

for ts, buf in pcap:
    eth = dpkt.ethernet.Ethernet(buf)
    print eth

I get junk values instead of getting the following output:

Ethernet(src='\x00\x1a\xa0kUf', dst='\x00\x13I\xae\x84,', data=IP(src='\xc0\xa8\n\n', off=16384, dst='C\x17\x030', sum=25129, len=52, p=6, id=51105, data=TCP(seq=9632694, off_x2=128, ack=3382015884, win=54, sum=65372, flags=17, dport=80, sport=56145)))

can anyone please tell me how to get this above output?

Solution

  • Be sure the file is opened to read as binary.

    https://stackoverflow.com/a/15746971

    f = open(pcapfile, 'rb')
pcap = dpkt.pcap.Reader(f)

for ts, buf in pcap:
    eth = dpkt.ethernet.Ethernet(buf)
    print(eth)