pypcapfile 0.12.0

git clone git://github.com/kisom/pypcapfile.git
cd pypcapfile
./setup.py install

简介

核心功能在pcapfile.savefile：

>>>frompcapfileimportsavefile>>>testcap=open('test.pcap','rb')>>>capfile=savefile.load_savefile(testcap,verbose=True)[+]attemptingtoloadtest.pcap[+]foundvalidheader[+]loaded11packets[+]finishedloadingsavefile.>>>printcapfilelittle-endiancapturefileversion2.4microsecondtimeresolutionsnapshotlength:65535linklayertype:LINKTYPE_ETHERNETnumberofpackets:11

您可以查看capfile.packets：

>>>pkt=capfile.packets[0]>>>pkt.raw()<binarydatasnipped>>>>pkt.timestamp1343676707L

自动解码层

>>>frompcapfileimportsavefile>>>frompcapfile.protocols.linklayerimportethernet>>>frompcapfile.protocols.networkimportip>>>importbinascii>>>testcap=open('samples/test.pcap','rb')>>>capfile=savefile.load_savefile(testcap,verbose=True)[+]attemptingtoloadsamples/test.pcap[+]foundvalidheader[+]loaded3packets[+]finishedloadingsavefile.>>>eth_frame=ethernet.Ethernet(capfile.packets[0].raw())>>>printeth_frameethernetfrom00:11:22:33:44:55toff:ee:dd:cc:bb:aatypeIPv4>>>ip_packet=ip.IP(binascii.unhexlify(eth_frame.payload))>>>printip_packetipv4packetfrom192.168.2.47to173.194.37.82carrying44bytes

这个例子：

>>>frompcapfileimportsavefile>>>testcap=open('samples/test.pcap','rb')>>>capfile=savefile.load_savefile(testcap,layers=1,verbose=True)[+]attemptingtoloadsamples/test.pcap[+]foundvalidheader[+]loaded3packets[+]finishedloadingsavefile.>>>printcapfile.packets[0].packet.src00:11:22:33:44:55>>>printcapfile.packets[0].packet.payload<hexstringsnipped>

最后：

>>>frompcapfileimportsavefile>>>testcap=open('samples/test.pcap','rb')>>>capfile=savefile.load_savefile(testcap,layers=2,verbose=True)>>>printcapfile.packets[0].packet.payloadipv4packetfrom192.168.2.47to173.194.37.82carrying44bytes

界面还是有点乱。

未来计划改进

• IP选项解析（支持END和NOP）
• IPv6支持
• TCP选项分析
• ARP支持

待办事项

1. 编写单元测试
2. 添加显示中所有字段值的__repr__方法 IP数据包 和以太网帧

另请参见

• 这个项目是PyPi page。
• 项目的Sphinxdocumentation on PyPI
• libpcap homepage

贡献者

项目的贡献者列表可以在AUTHORS文件中找到