
python处理wireshark抓取的pcap数据包
【代码】python处理wireshark抓取的pcap数据包。
·
from scapy.all import *
import multiprocessing
import os
def ExPcap(file_name):
file = rdpcap(file_name)
PacketLength = len(file)
#过滤筛选需要的数据包
for t in range(PacketLength):
if file[t].haslayer(ARP) == True:
wrpcap(file_name[:-6] + '_filter.pcap',file[t],append=True)
continue
elif file[t].haslayer(UDP) == True:
wrpcap(file_name[:-6] + '_filter.pcap', file[t],append=True)
continue
else:
continue
def CalPcap(file_name):
file = rdpcap(file_name)
PacketLength = len(file)
#筛选丢包及计算间隔
for t in range(PacketLength-1):
if file[t].haslayer(ARP) == True:
if file[t][Ether].src == '68:f7:28:11:49:e8':
if file[t + 1].haslayer(UDP) == True:
if file[t + 5].haslayer(UDP) == False:
DeltaTime = file[t + 1].time - file[t].time
if DeltaTime * 1000 < 0.1:
print(file[t].time)
print(file[t + 1].time)
print(DeltaTime * 1000)
if __name__ == '__main__':
PcapList = os.listdir()
for name in PcapList:
if name[-4:] == 'pcap':
process = multiprocessing.Process(target=ExPcap(name))
process.start()
PcapList = os.listdir()
for name in PcapList:
if name[-6:] == 'r.pcap':
process = multiprocessing.Process(target=CalPcap(name))
process.start()
更多推荐
所有评论(0)