python绝技中对wireshark数据包分析dpkt、scapy以及geoip2的使用方法。案例获取wireshark数据包中的ip地址，并查询ip地址归属城市。

最新推荐文章于 2024-08-09 07:14:52 发布

devil8123665

最新推荐文章于 2024-08-09 07:14:52 发布

阅读量828

点赞数

分类专栏：语言文章标签： python

本文链接：https://blog.csdn.net/devil8123665/article/details/105168639

版权

语言专栏收录该内容

36 篇文章 1 订阅

订阅专栏

一 dpkt 

#!C:\Python37
# -*- coding:utf-8 -*-

import dpkt
import socket
from scapy.all import *
import geoip2.database
import optparse


def PrintPcap_dpkt(filename):
    iplist = []
    try:
        filepcap = open(filename,'rb')
        pcap = dpkt.pcap.Reader(filepcap)
        for (ts,buf) in pcap:
            eth = dpkt.ethernet.Ethernet(buf)

            ip = eth.data
            src = socket.inet_ntoa(ip.src)
            dst = socket.inet_ntoa(ip.dst)
            if not str(src) in iplist:
                iplist.append(str(src))
            if not str(dst) in iplist:
                iplist.append(str(dst))

            print(f'[+]Src:{src}--->Dst:{dst}')

        filepcap.close()
        print(iplist)
        return iplist
    except Exception as e:
        print(e)
        pass
    return

def PrintPcap_scapy(filename):
    iplist = []
    try:
        pcap = rdpcap(filename)
        for rd in pcap:
            #print(rd.show())
            if rd['IP'].payload:
                src = rd['IP'].src
                dst = rd['IP'].dst
                print(f'[+]Src:{src}--->Dst:{dst}')
                if not str(src) in iplist:
                    iplist.append(str(src))
                if not str(dst) in iplist:
                    iplist.append(str(dst))
        return iplist

    except Exception as e:
        print(e)
        pass

    return

def retGeoStr(iplist,geoLiteCity='./GeoLiteCity/GeoLiteCity.mmdb'):
    #iplist =['10.0.0.101', '10.0.0.201']
    if  len(iplist) < 1:
        print("[*] no IP")
        return
    try:
        reader = geoip2.database.Reader(geoLiteCity,['zh-CN'])
    except Exception as e:
        print(e)
        return
    for ip in iplist:
        print(ip)
        try:
            resp = reader.city(ip)  # type:geoip2.models.City
            # print(resp)
            country = str(resp.country.name)
            city = str(resp.city.name)
            print('[+]IP:{},is {} {}'.format(ip, country, city))
        except Exception as e:
            print(e)
            pass

    return



def main():
    #filename = './file/sqli.pcap'
    geoLiteCity ='./GeoLiteCity/GeoLIteCity.mmdb'
    parser = optparse.OptionParser('usage -p <pcap file>')
    parser.add_option('-p', dest = 'filename', type = 'string', help = 'specify a pcap file')
    (options,args) = parser.parse_args()
    filename = options.filename
    if (filename == None):
        print(parser.usage)
        exit(0)

    iplist =PrintPcap_dpkt(filename)
    #PrintPcap_scapy(filename)

    retGeoStr(iplist)
    return


if __name__ == '__main__':
    main()