import struct
import time
def rdpcap(pcap_file):
with open(pcap_file, "rb") as f: # 读取抓包文件
content = f.read()
pcap_header = content[:24] # 切片获取pcap头部
print(pcap_header)
content = content[24:]
while content: # 开始解析抓包文件
# 抓包的时间戳, 即秒和毫秒, 可以转换为yyyy/mm/dd hh:mm:ss时间格式
second, micro_second = struct.unpack("2I", content[:8])
msec = float("{}.{}".format(second,micro_second))
_, pkt_length = struct.unpack("2I", content[8:16]) # 获取报文长度
print(time.strftime("%Y/%m/%d %H:%M:%S", time.localtime(msec)), pkt_length)
content = content[16 + pkt_length:]