用scapy解析出pcap文件的http报文

p.show函数可以分层次打印pcap文件的内容
例程序1：

#encoding=utf-8
import scapy.all as scapy
'''
try:
    # This import works from the project directory
    import scapy_http.http
except ImportError:
    # If you installed this package via pip, you just need to execute this
    from scapy.layers import http
'''
packets = scapy.rdpcap("/home/amos/learn_data/tump_http.pcap")  # 读取pcap文件
'''
rdpcap(filename, count=-1)
Read a pcap file and return a packet list
count: read only <count> packets
'''
print packets[46].show()

---

输出结果：

[ Ethernet ]

dst = 00:19:21:11:2e:90
src = 48:0f:cf:38:05:e4
type = 0x800

[ IP ]

 version   = 4L
 ihl       = 5L
 tos       = 0x0
 len       = 524
 id        = 6597
 flags     = DF
 frag      = 0L
 ttl       = 64
 proto     = tcp
 chksum    = 0xf246
 src       = 219.245.186.241
 dst       = 219.245.186.3
 \options   \

[ TCP ]

    sport     = 57447
    dport     = http
    seq       = 1199195183
    ack       = 1123214974
    dataofs   = 8L
    reserved  = 0L
    flags     = PA
    window    = 501
    chksum    = 0x2edf
    urgptr    = 0
    options   = [('NOP', None), ('NOP', None), ('Timestamp', (1040357825, 1152646))]

[ Raw ]