从pcap文件中分析出数据包

import dpkt
import struct
import sys,os

f=file(sys.argv[1],"rb")
pcap=dpkt.pcap.Reader(f)

for ts, buf in pcap:
    eth=dpkt.ethernet.Ethernet(buf)
    ip=eth.data
    tcp=ip.data

    if eth.type == dpkt.ethernet.ETH_TYPE_IP:
        src_tuple = map(ord, ip.src)
        print "src ip addr: (%d.%d.%d.%d)" % ((src_tuple[0]), (src_tuple[1]), (src_tuple[2]), (src_tuple[3])),
        dst_tuple = map(ord, ip.dst)
        print "dst ip addr: (%d.%d.%d.%d)" % ((dst_tuple[0]), (dst_tuple[1]), (dst_tuple[2]), (dst_tuple[3]))

使用dpkt库

转载于:https://www.cnblogs.com/long123king/p/3605558.html