使用
pylibcap.它提供了libpcap的接口,libpcap是linux上数据包嗅探的事实标准.要解析数据包,您可能希望使用
construct库,因为它已包含TCP数据包的解析器.
这是一个小例子程序:
import pcap
from construct.protocols.ipstack import ip_stack
def print_packet(pktlen, data, timestamp):
if not data:
return
stack = ip_stack.parse(data)
payload = stack.next.next.next
print payload
p = pcap.pcapObject()
p.open_live('eth0', 1600, 0, 100)
p.setfilter('dst port 80', 0, 0)
print 'Press CTRL+C to end capture'
try:
while True:
p.dispatch(1, print_packet)
except KeyboardInterrupt:
print # Empty line where ^C from CTRL+C is displayed
print '%d packets received, %d packets dropped, %d packets dropped by interface' % p.stats()