python提取数据包中的文件_分享一个使用python的scapy包来提取pcap文件中TCP数据包的标志位的代码...

如题所述，分享一个使用python的scapy包来提取pcap文件中TCP包的标志位的代码。

from scapy.all import *

FIN = 0x01

SYN = 0x02

RST = 0x04

PSH = 0x08

ACK = 0x10

URG = 0x20

ECE = 0x40

CWR = 0x80

caida = "/home/zongyi/traces/CAIDA.equinix-nyc.dirA.20180315-125910.UTC.anon.pcap"

limit = 5000

count = 0

def func(pkt):

global count, limit

srcip, dstip, proto, sport, dport = None, None, None, None, None

if pkt.haslayer(IP):

srcip = pkt[IP].src

dstip = pkt[IP].dst

proto = pkt[IP].proto

if pkt.haslayer(TCP):

sport = pkt[TCP].sport

dport = pkt[TCP].dport

if pkt[TCP].flags & FIN:

print count, "FIN flag is activated"

if pkt[TCP].flags & RST:

print count, "RST flag is activated"

if pkt[TCP].flags & SYN:

print count, "SYN flag is activated"

elif pkt.haslayer(UDP):

sport = pkt[UDP].sport

dport = pkt[UDP].dport

if srcip and dstip and proto and sport and dport:

count = count + 1

if limit > 0 and count >= limit:

return True

else:

return False

def parse(trace, n_pkts = -1):

global limit, count

limit = n_pkts

count = 0

sniff(offline=trace, stop_filter=func, store=False)

parse(caida, 5000)