Python处理网络数据包示例(pcapy读pcap文件)

最近在围观python，找了个pcapy处理pcap数据的代码

非常非常久以前的东西了，应该是在项目组做的半成品吧。今天重装机器，不经意翻出来了。这个脚本是读入一个libpcap保存的文件，按照要求过滤数据，最后将过滤后的数据保存到一个新文件中。运行环境应该是2.5吧。

原文在http://muyublog.appspot.com/2010/08/31/python-pcapy.html

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

#!/usr/bin/python

# Copyright (c) 2007

#

# Pcap dump file filter.

#

# This tools filter some packets in pcap capture files

# here is the packet send by our robot

#

# Authors:HonetNet Project

#

import sys

import string

from exceptions import Exception

import pcapy

from pcapy import *

def Drop(data):

"""Check if this packet should be drop

"""

#return True

return False

def filefilter(filename):

"""filter a single file

"""

# Open file

try:

processor = open_offline(filename)

except pcapy.PcapError, e:

print "Can't open file: "+filename

print "\t",e

return 1

#check if it's the Ether packet

if pcapy.DLT_EN10MB != processor.datalink():

print "Not a Ethernet packet..."

return 2

#Open the file store the data after filter

if sys.platform == 'win32':

pos = filename.rfind('\\')

elif sys.platform == 'linux2':

pos = filename.rfind('/')

else:

print "Running on a unexpect OS"

sys.exit(1)

if pos == -1:

newfile = "filtered-"+filename

else:

newfile = filename[:pos+1] + 'filtered-' + filename[pos+1:]

print newfile

try:

global dumper

dumper = processor.dump_open(newfile)

except pcapy.PcapError, e:

print "Can't write packet to:", newfile

print "\t",e

return 3 www.2cto.com

processor.loop(0, packetHandler)

def packetHandler(hdr, data):

"""process with single packet

"""

if not Drop(data):

global dumper

dumper.dump(hdr, data)

# Process command-line arguments.

if __name__ == '__main__':

if len(sys.argv) <= 1:

print "Usage: %s " % sys.argv[0]

sys.exit(1)

filefilter(sys.argv[1])

相关内容

暂无相关文章