Parsing a pcap file in python [duplicate]
I would use python-dpkt.Here is the documentation.
This is all I know how to do though sorry.
#!/usr/local/bin/python2.7import dpktcounter=0ipcounter=0tcpcounter=0udpcounter=0filename='sampledata.pcap'for ts, pkt in dpkt.pcap.Reader(open(filename,'r')): counter+=1 eth=dpkt.ethernet.Ethernet(pkt) if eth.type!=dpkt.ethernet.ETH_TYPE_IP: continue ip=eth.data ipcounter+=1 if ip.p==dpkt.ip.IP_PROTO_TCP: tcpcounter+=1 if ip.p==dpkt.ip.IP_PROTO_UDP: udpcounter+=1print "Total number of packets in the pcap file: ", counterprint "Total number of ip packets: ", ipcounterprint "Total number of tcp packets: ", tcpcounterprint "Total number of udp packets: ", udpcounterUpdate: