用Python dpkt 来解析 pcap ,,

import pcap, dpkt, dnet
import sys

class Readpcap():
    def __init__(self):
        self.pc = pcap.pcap("aaa.pcap",0,0,False)
    def printsocket(self):
        while True:
            aa = self.pc.next();
            if(aa == None):
                break
            (ti,pkt ) = aa;
            ff = dpkt.ethernet.Ethernet(pkt)
            if(ff.type != 2048):
                continue;
            self.ippkt = ff.data;
            if self.ippkt.p == 6:
                print str(self.ippkt.len)+"\t"+"tcp"
            elif self.ippkt.p == 17:
                print str(self.ippkt.len)+"\t"+"udp"
def test():
    mm = Readpcap();
    mm.printsocket();
if __name__ == '__main__':
    test()

编程技巧