Parsing pcap files with the Python library Scapy

Every time I write a blog is from wondering, python parsing pcap so commonly used examples online is not, all a bunch of command line execution of python, can use? Can we use it?

pip to install scapy and then parse pcap:

import scapy
from  import *
from  import PcapReader
packets=rdpcap("./")
for data in packets:
  if 'UDP' in data:
    s = repr(data)
    print(s)
    print(data['UDP'].sport)
    break

Print s to see all the fields:

<Ether dst=ff:ff:ff:ff:ff:ff src=30:fc:68:33:7a:e2 type=0x800 |<IP version=4 ihl=5 tos=0x0 len=143 id=37312 flags= frag=0 ttl=64 proto=udp chksum=0x644d src=192.168.1.1 dst=192.168.1.255 options=[] |<UDP sport=1024 dport=5001 len=123 chksum=0x3051 |<Raw load='\x01\x01\x0e\x00\xe1+\x83\xc7\xb2\x9f\x00e\x00\x00\x00\x06\x00\tTL-WR886N\x00\x0b\x00\x035.0\x00\x07\x00\x01\x01\x00\x05\x00\x1130-fc-68-33-7a-e2\x00\x08\x00\x0b192.168.1.1\x00\t\x00\\x00\n\x00\rTL-WR886N 5.0\x00\x0c\x00\x051.7.3' |>>>>

Then you can print the source port of udp with data['UDP'].sport.

Now the basic fields are visible, if you still want to see the fields of other protocols, you can refer to the source code:

/secdev/scapy/tree/master/scapy/layers

Layer L2 is in, ip, tcp, etc. in, for example some field names for tcp are here:

The above method of parsing pcap files using the Python library Scapy is all I have to share with you, I hope it will give you a reference, and I hope you will support me more.