import dpkt
import struct
import sys,os
f=file(sys.argv[1],"rb")
pcap=dpkt.pcap.Reader(f)
for ts, buf in pcap:
eth=dpkt.ethernet.Ethernet(buf)
ip=eth.data
tcp=ip.data
if eth.type == dpkt.ethernet.ETH_TYPE_IP:
src_tuple = map(ord, ip.src)
print "src ip addr: (%d.%d.%d.%d)" % ((src_tuple[0]), (src_tuple[1]), (src_tuple[2]), (src_tuple[3])),
dst_tuple = map(ord, ip.dst)
print "dst ip addr: (%d.%d.%d.%d)" % ((dst_tuple[0]), (dst_tuple[1]), (dst_tuple[2]), (dst_tuple[3]))
使用dpkt库