在csv文件python中打印输出

Question

My code that is used to print the output of the pcap file IP's IN CSV FILE is working well but the issue is it is storing only 1st packet of the pcap file. I am not getting where is the actual issue is.. can someone help me to solve this then please.

Here is my code:

import dpkt
from dpkt.ip import IP
from dpkt.ethernet import Ethernet
import struct
import socket
import csv

def ip_to_str(address):
    return socket.inet_ntoa(address)

f = open('sample.pcap', 'rb')
pcap = dpkt.pcap.Reader(f)
for ts, buf in pcap:
    eth = dpkt.ethernet.Ethernet(buf)
    if eth.type != dpkt.ethernet.ETH_TYPE_IP:
        continue

    ip = eth.data
    do_not_fragment = bool(dpkt.ip.IP_DF)
    more_fragments = bool(dpkt.ip.IP_MF)
    fragment_offset = bool(dpkt.ip.IP_OFFMASK)
    c = csv.writer(open("a.csv", "wb"))

    Source = "%s" % ip_to_str(ip.src)
    Destination = "%s" % ip_to_str(ip.dst)
    Length = "%d" % (ip.len)
    TTL = "%d" % (ip.ttl)
    OFF = ip.off
    TOS = ip.tos
    Protocol = ip.p
    data = (Source, Destination, Length, TTL, TOS, OFF, Protocol)
    c.writerow(data)

Answer 1

Your code is currently opening a csv file inside the loop, so each time creating a new version of "a.csv" and only writing one packet to it. Move the file creation statement outside of the loop, and keep writing inside the loop.

import dpkt
from dpkt.ip import IP
from dpkt.ethernet import Ethernet
import struct
import socket
import csv

def ip_to_str(address):
    return socket.inet_ntoa(address)

f = open('sample.pcap', 'rb')
pcap = dpkt.pcap.Reader(f)
c = csv.writer(open("a.csv", "wb"))  # <=== moved here
for ts, buf in pcap:
    eth = dpkt.ethernet.Ethernet(buf)
    if eth.type != dpkt.ethernet.ETH_TYPE_IP:
        continue

    ip = eth.data
    do_not_fragment = bool(dpkt.ip.IP_DF)
    more_fragments = bool(dpkt.ip.IP_MF)
    fragment_offset = bool(dpkt.ip.IP_OFFMASK)

    Source = "%s" % ip_to_str(ip.src)
    Destination = "%s" % ip_to_str(ip.dst)
    Length = "%d" % (ip.len)
    TTL = "%d" % (ip.ttl)
    OFF = ip.off
    TOS = ip.tos
    Protocol = ip.p
    data = (Source, Destination, Length, TTL, TOS, OFF, Protocol)
    c.writerow(data)

Answer 2

You need to make sure you close the file at the end of your loop; and as mentioned indent your code properly:

import struct
import socket
import csv

import dpkt

from dpkt.ip import IP
from dpkt.ethernet import Ethernet

def ip_to_str(address):
    return socket.inet_ntoa(address)

with open('sample.pcap', 'rb') as f:
    pcap = dpkt.pcap.Reader(f)

results = []
for ts, buf in pcap:
    eth = dpkt.ethernet.Ethernet(buf)
    if eth.type != dpkt.ethernet.ETH_TYPE_IP:
        continue

    ip = eth.data
    do_not_fragment = bool(dpkt.ip.IP_DF)
    more_fragments = bool(dpkt.ip.IP_MF)
    fragment_offset = bool(dpkt.ip.IP_OFFMASK)

    data = [ip_to_str(ip.src),
            ip_to_str(ip.dst),
            ip.len,
            ip.ttl,
            ip.off,
            ip.tos,
            ip.p]
    results.append(data)

with open('output.csv', 'wb') as f:
    writer = csv.writer(f, delimiter=',', quotechar='"')
    writer.writerows(results)