Search code examples
pythonwiresharkpacket

python network analysis: export DICOM object from pcap file

In Wireshark I can use the feature "export object => DICOM" to extract from network packets the DICOM file sent.

I would like to do the same thing with Python or with Wireshark API, is it possible?

Solution

  • If we're using python and tshark, this is mostly a call to subprocess as tshark already has this capability:

    import subprocess as sp
import os

# Source file
pcap_file = "C:\\...\\DICOM.pcap"
dest_dir = "exported"
os.mkdir(dest_dir)
# Read the file and use --export-objects. Next arg must be `protocol,dir`.
sp.run(["tshark", "-Q", "-r", pcap_file, "--export-objects", "DICOM," + dest_dir])

    Then if you ls exported, you'll see the exported file(s). I have tested and verified that this wireshark bug file has a dicom file that you can export with these commands.

    If you want to better understand the extraction process, Wireshark is open source and you can look at its DICOM code.