python 利用 dpkt 读取pcap文件并解析

要使用dpkt库读取pcap文件并解析，可以按照以下步骤进行操作：

• 导入所需的库：

python

import dpkt
import datetime
import socket
from dpkt.compat import compat_ord
from dpkt.ip import get_ip_proto_name

• 定义一些辅助函数，如mac_addr用于将MAC地址转换为可读字符串，inet_to_str用于将IP地址转换为可读字符串：

python

def mac_addr(address):
    """convert a mac address to a readable/printable string
    args:
        address (str): a mac address in hex form (e.g. '\x01\x02\x03\x04\x05\x06')
    returns:
        str: printable/readable mac address
    """
    return ':'.join('%02x' % compat_ord(b) for b in address)

def inet_to_str(inet):
    """convert an inet object to a string
    args:
        inet (inet struct): inet network address
    returns:
        str: printable/readable ip address
    """
    # try ipv4 and then ipv6
    try:
        return socket.inet_ntop(socket.AF_INET, inet)
    except ValueError:
        return socket.inet_ntop(socket.AF_INET6, inet)

• 实现print_packets函数，用于打印每个数据包的相关信息：

python

def print_packets(pcap):
    """print out information about each packet in a pcap
    args:
        pcap: dpkt pcap reader object (dpkt.pcap.Reader)
    """
    # for each packet in the pcap process the contents
    for timestamp, buf in pcap:
        # print out the timestamp in utc
        print('timestamp:', str(datetime.datetime.utcfromtimestamp(timestamp)))

        # unpack the ethernet frame (mac src/dst, ethertype)
        eth = dpkt.ethernet.Ethernet(buf)
        print('ethernet frame:', mac_addr(eth.src), mac_addr(eth.dst), eth.type)

        # make sure the ethernet data contains an ip packet
        if not isinstance(eth.data, dpkt.ip.IP):
            print('non-ip packet type not supported %s\n' % eth.data.__class__.__name__)
            continue

        # now unpack the data within the ethernet frame (the ip packet)
        # pulling out src, dst, length, fragment info, ttl, and protocol
        ip = eth.data

        # pull out fragment information (flags and offset all packed into off field, so use bitmasks)
        do_not_fragment = bool(ip.off & dpkt.ip.IP_DF)
        more_fragments = bool(ip.off & dpkt.ip.IP_MF)
        fragment_offset = ip.off & dpkt.ip.IP_OFFMASK

        protocol = get_ip_proto_name(ip.p)

        # print out the info
        print('ip: %s -> %s (len=%d ttl=%d df=%d mf=%d offset=%d protocol=%s)\n' %
              (inet_to_str(ip.src), inet_to_str(ip.dst), ip.len, ip.ttl, do_not_fragment, more_fragments,
               fragment_offset, protocol))

• 在主程序中打开pcap文件，然后调用print_packets函数打印数据包信息：

python

if __name__ == '__main__':
    with open('pcap/2021_11_02_idle.pcap', 'rb') as f:
        pcap = dpkt.pcap.reader(f)
        print_packets(pcap)

在上述代码中，我们打开了一个名为2021_11_02_idle.pcap的pcap文件，并将其传递给print_packets函数进行解析和打印。

请确保将'pcap/2021_11_02_idle.pcap'替换为你实际的pcap文件路径。运行代码后，它将打印出每个数据包的时间戳、以太网帧信息、IP数据包信息等。