N
N
Nikolai2021-06-09 09:44:02
Parsing
Nikolai, 2021-06-09 09:44:02

Splitting pcap into sessions using the scapy module?

There is a large pcap file compiled with Wireshark. It is necessary to separate TCP and UDP sessions from it using the scapy module. It is clear that it is not difficult to write, highlighting TCP sessions using ip_src:port - ip_dst:port, but maybe there are ready-made solutions?

Answer the question

In order to leave comments, you need to log in

1 answer(s)
A
Alexander, 2021-06-17
@avorsa

for (packet_data, packet_metadata) in RawPcapReader(infile):   # перебираем все пакеты
    ether_pkt = Ether(packet_data)  # выделяем слой Ethernet
    ip_pkt = ether_pkt[IP] # дальше слой IP
    if ip_pkt.haslayer(TCP): # проверяем есть ли TCP слой ниже
        # раскладываем пакеты по разным спискам
        # чтобы в конце записать их в файл с помощью конструкции 
        # wrpcap("any_file.pcap", list_of_packets)

Same with UDP.
Alternatively, all this can be done with filters in Wireshark

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question