简体   繁体   中英

Getting a particular package from the pcap file using the Scapy module (python)

Is there a way to load a particular package from the pcap file using Scapy?

I know that I can load a specific number of packages using the' sniff' function and count attribute, eg'

sniff(offline='file.pcap', prn=action, count=31)

However, I need to get a 30th packet without loading the previous packets. In other words, I am not satisfied with such an example:

packages = (pkt for pkt in sniff (offline=path, prn=action, count=31) 
print(packages[30])

The attempt to load a millionth of a package is too long.

Each packet header states how long it is. Once the parser has read that header, it can calculate the position of the next one. So as far as I know, you cannot open a pcap file and instantly locate packet 30; you'll need to parse the headers of the first 29.

But you don't have to keep all packets in memory either, as long as you process them while receiving.

i = 0
for pkt in sniff(offline=path, prn=action):
    if i == 30:
        print pkt
        break

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM