如何使python在Linux上使用管道读取tcpdump捕获的.pcap数据？

Question

Recently I manage to capture tcp data from my Raspberry Pi 3B+ Board to Wireshark on my local machine for realtime processing, but now I would like to capture the column "data" in "TCP" section with python in real time and send data of this columns via TCP port to another application listening on port 1234.

I think I try in a wrong way. My tries are shown below:

the command below make wireshark can analysis the tcp stream of another machine in realtime.

ssh root@10.0.1.2 tcpdump -ns 0 -i eth0 "not port 22" | wireshark -k -i -

it works, and wireshark can work in real-time. I want to dump and display some data in every packet that match my requirement in terminal base on these command, so I try to filter my wanted column started by:

ssh root@10.0.1.2 tcpdump -ns 0 -i eth0 "not port 22" | python test.py

and file test.py as show below:

import sys
k = 0
try:
   for line in iter(sys.stdin.readline, b''):
      k = k + 1
      print(line)
except KeyboardInterrupt:
   sys.stdout.flush()
   pass
print(k)

but just can not display anything.

by the way, the tcp stream is transport in binary mode.

I want to get some specified data in tcp data in real-time(or 90% real-time) capture by tcpdump, but I try some ways and won't work.

I also try to use the command that enable wireshark to analysis in real-time and then forward the data to python scripts, I search google for 2 days with zero results matched.

If anyone cool enough to help me with this? I'll be very grateful, Thank you!

Answer 1

Here's a simple example of how to pipe to a python script.

import sys
import fileinput


incoming = fileinput.input(sys.argv[1:])
for line in incoming:
    print line.rstrip()

also python -u might help

-u     Force  stdin,  stdout  and  stderr to be totally unbuffered.  On
              systems where it matters, also put stdin, stdout and  stderr  in
              binary  mode.   Note  that there is internal buffering in xread‐
              lines(), readlines() and file-object  iterators  ("for  line  in
              sys.stdin")  which  is  not  influenced by this option.  To work
              around this, you will want to use "sys.stdin.readline()"  inside
              a "while 1:" loop.