Pyshark分析pcap文件

Filtering packets:

Filtering packets can be done with any capture object, like so:

filtered_cap = pyshark.FileCapture(path_to_file, display_filter='http')
filtered_cap2 = pyshark.LiveCapture('eth0', bpf_filter='tcp port 80')

There are two types of filters, BPF filters and display filters. Generally, bpf filters are more limited but are faster while display filters can be used on pretty much any attribute of the packet but are much slower.

Note: there is currently an ISSUE with BPF filters on FileCapture and it is not recommended it be used.

See BPF syntax help HERE and display filters help HERE.

Note: we recommended using “Wireshark - Preparing and Applying Filters Feature” to select the filters.

Demo for analyzing arp packet

$ ipython
Python 2.7.8 (default, Jul  2 2014, 22:10:09)
Type "copyright", "credits" or "license" for more information.

IPython 4.2.0 -- An enhanced Interactive Python.
?         -> Introduction and overview of IPython's features.
%quickref -> Quick reference.
help      -> Python