在Python Scapy中从STDIN读取.pcap文件

Question

is there a way how to read .pcap from stdin in Python Scapy (using rdpcap)? Every time I try anything I got an error (can't read the file).

The usage is like this:

python main.py < test_linux.pcap

I have already implemented reading a file using parameters but I also need reading from STDIN.

Thanks a lot.

Answer 1

The rdpcap() interface takes a filename and only a filename as it internally performs the open(filename) operation on that filename. Here's a workaround via tempfile:

from scapy.all import *
import tempfile
import sys

if __name__=="__main__":
  ftmp = tempfile.NamedTemporaryFile(delete=True)
  ftmp.write(sys.stdin.read())
  ftmp.flush()
  print rdpcap(ftmp.name)
  ftmp.close()

If you do not want to work around with a tempfile you'll have to re-implement RawPcapReader and PcapReader to take a FD instead of the filename.

from scapy.all import *
import sys

class RawPcapReaderFD(RawPcapReader):
    """A stateful pcap reader. Each packet is returned as a string"""

    def __init__(self, fd):
        self.filename = "dummy"
        try:
            self.f = fd
            magic = self.f.read(4)
        except IOError:
            self.f = fd
            magic = self.f.read(4)
        if magic == "\xa1\xb2\xc3\xd4": #big endian
            self.endian = ">"
        elif  magic == "\xd4\xc3\xb2\xa1": #little endian
            self.endian = "<"
        else:
            raise Scapy_Exception("Not a pcap capture file (bad magic)")
        hdr = self.f.read(20)
        if len(hdr)<20:
            raise Scapy_Exception("Invalid pcap file (too short)")
        vermaj,vermin,tz,sig,snaplen,linktype = struct.unpack(self.endian+"HHIIII",hdr)

        self.linktype = linktype

class PcapReader(RawPcapReaderFD):
    def __init__(self, fd):
        RawPcapReaderFD.__init__(self, fd)
        try:
            self.LLcls = conf.l2types[self.linktype]
        except KeyError:
            warning("PcapReader: unknown LL type [%i]/[%#x]. Using Raw packets" % (self.linktype,self.linktype))
            self.LLcls = conf.raw_layer


print PcapReader(sys.stdin).read_all(-1)

Answer 2

The answer by @tintin is totally correct, but now scapy can use a file descriptor as argument for rdpcap() and PcapReader() .

So rdpcap(sys.stdin) should just work as expected (if you use a recent enough version of Scapy)!