使用 Scapy 模块 (python) 从 pcap 文件中获取特定包

Question

Is there a way to load a particular package from the pcap file using Scapy?

I know that I can load a specific number of packages using the' sniff' function and count attribute, eg'

sniff(offline='file.pcap', prn=action, count=31)

However, I need to get a 30th packet without loading the previous packets. In other words, I am not satisfied with such an example:

packages = (pkt for pkt in sniff (offline=path, prn=action, count=31) 
print(packages[30])

The attempt to load a millionth of a package is too long.

Answer 1

Each packet header states how long it is. Once the parser has read that header, it can calculate the position of the next one. So as far as I know, you cannot open a pcap file and instantly locate packet 30; you'll need to parse the headers of the first 29.

But you don't have to keep all packets in memory either, as long as you process them while receiving.

i = 0
for pkt in sniff(offline=path, prn=action):
    if i == 30:
        print pkt
        break