Answer the question
In order to leave comments, you need to log in
Splitting pcap into sessions using the scapy module?
There is a large pcap file compiled with Wireshark. It is necessary to separate TCP and UDP sessions from it using the scapy module. It is clear that it is not difficult to write, highlighting TCP sessions using ip_src:port - ip_dst:port, but maybe there are ready-made solutions?
Answer the question
In order to leave comments, you need to log in
for (packet_data, packet_metadata) in RawPcapReader(infile): # перебираем все пакеты
ether_pkt = Ether(packet_data) # выделяем слой Ethernet
ip_pkt = ether_pkt[IP] # дальше слой IP
if ip_pkt.haslayer(TCP): # проверяем есть ли TCP слой ниже
# раскладываем пакеты по разным спискам
# чтобы в конце записать их в файл с помощью конструкции
# wrpcap("any_file.pcap", list_of_packets)
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question