Example of how Python processes network data packets (pcapy reads pcap files)

Recently, in python, I found a pcapy code to process pcap data.
 
Something that was a long time ago should have been a semi-finished product in the project team. Today, I reinstalled the machine and accidentally turned it out. This script reads a file saved by libpcap, filters data as required, and finally saves the filtered data to a new file. The running environment should be 2.5.
 
Original in http://muyublog.appspot.com/2010/08/31/python-pcapy.html
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
#! /Usr/bin/python
# Copyright (c) 2007
#
# Pcap dump file filter.
#
# This tools filter some packets in pcap capture files
# Here is the packet send by our robot
#
# Authors: HonetNet Project
#
 
Import sys
Import string
From exceptions import Exception
Import pcapy
From pcapy import *
 
Def Drop (data ):
"Check if this packet shoshould be drop
"""
# Return True
Return False
 
Def filefilter (filename ):
"Filter a single file
"""
# Open file
Try:
Processor = open_offline (filename)
Handle t pcapy. PcapError, e:
Print "Can't open file:" + filename
Print "\ t", e
Return 1
 
# Check if it's the Ether packet
If pcapy. DLT_EN10MB! = Processor. datalink ():
Print "Not a Ethernet packet ..."
Return 2
 
# Open the file store the data after filter
If sys. platform = 'win32 ':
Pos = filename. rfind ('\\')
Elif sys. platform = 'linux2 ':
Pos = filename. rfind ('/')
Else:
Print "Running on a unexpect OS"
Sys. exit (1)
If pos =-1:
Newfile = "filtered-" + filename
Else:
Newfile = filename [: pos + 1] + 'filtered-'+ filename [pos + 1:]
Print newfile
Try:
Global dumper
Dumper = processor. dump_open (newfile)
Handle t pcapy. PcapError, e:
Print "Can't write packet to:", newfile
Print "\ t", e
Return 3 www.2cto.com
Processor. loop (0, packetHandler)
 
Def packetHandler (hdr, data ):
"Process with single packet
"""
If not Drop (data ):
Global dumper
Dumper. dump (hdr, data)
 
# Process command-line arguments.
If _ name _ = '_ main __':
If len (sys. argv) & lt; = 1:
Print "Usage: % s" % sys. argv [0]
Sys. exit (1)
Filefilter (sys. argv [1])