Python grab packet intercepts HTTP log

#!/usr/bin/python

Import Pcap

Import DPKT

Import re

def main ():

Pc=pcap.pcap (name= "eth1") # crawl Eth1

Pc.setfilter (' TCP port 80 ') # Filter expression TCP port 80

For P_time, p_data in PC: #

ret = Main_pcap (P_time, P_data)

IF RET:

Print ret

def main_pcap (P_time, P_data): # decoding

Out_format = "%s\t%s\t%s\t%s\t%s\thttp/%s"

p = dpkt.ethernet.Ethernet (p_data) #

RET = None

if p.data.__class__.__name__ = = ' IP ':

Ip_data = P.data

src_ip = '%d.%d.%d.%d '% tuple (map (ord,list (IP_DATA.SRC)))

dst_ip = '%d.%d.%d.%d '% tuple (map (ord,list (IP_DATA.DST)))

If p.data.data.__class__.__name__== ' TCP ':

Tcp_data = P.data.data

If tcp_data.dport==80:

If Tcp_data.data:

h = dpkt.http.Request (tcp_data.data) # HTTP decoding

Pre = "^/.*$"

If match (pre, H.uri): # URL Rewrite

Http_headers = H.headers

Host = h.headers[' host ']

url = "http +/" + Host + H.uri

Else

URL = H.uri

# datetime SRCIP dstip get/index.htm http/1.1 # output Log format

ret = out_format% (p_time, src_ip, dst_ip, H.method, URL, h.version)

return ret

Def match (pre, line):

p = re.compile (PRE)

m = P.match (line)

return m

# script run also reached the Xiaoming等 expected, OK.

# Follow-up record referer is still necessary.

======================================================================================

Installation

1. Python 2.5

2. Pypcap python's grab function library

Http://code.google.com/p/pypcap/downloads/list

3. Dpkt python's unpacking function library

Http://code.google.com/p/dpkt/downloads/list

4. WinPcap Python supports PACP driver

If you have Wireshark, just install Wireshark, inside with WinPcap

In Linux there is a library called Libpcap can be competent. Libpcap is a simple and powerful library of packet capture functions that can be run on a variety of operating systems.

There are a few good tutorials on Libpcap:

Http://www.tcpdump.org/pcap.htm (Official guide, English, well-written for beginners)

Http://blog.csdn.net/bat603/archive/2006/09/04/1175729.aspx (Chinese description of main function)

Http://blog.csdn.net/bat603/archive/2006/09/04/1176251.aspx (Entry Source)

Python grab packet intercepts HTTP log