python - scapy - pcap

# -*- coding: utf-8 -*-
"""
Spyder Editor


This is a temporary script file.
"""


def func():
    pass


from scapy.all import *


'''
data = "HelloWorld"
pkt = IP(src='1.2.3.4', dst="5.6.7.8")/TCP(sport=12345,dport=54321)/data
send(pkt,inter=1,count=5,iface="eth0")
'''


a = Ether()/IP(dst="114.114.114.114")/TCP(dport=80)
a.show()


#sniff(filter="",iface="any", prn=function, count=N)
b = sniff(filter="host 1.2.3.4 and tcp", iface="Realtek PCIe GBE Family Controller", count=2)
print ("1")
b.show()
print ("2")






package = rdpcap("weblogic.pcap")
#print (package[0].show())
#print (package[0].len)
for i in package:
    i.show()
    print "Ethernet Layer -> dst: ", (i.dst) #Ethernet Layer
    print "IPLayer -> version: ", (i.payload.version) #IPLayer
    print "TCP/UDP -> sport: ", (i.payload.payload.sport) #TCP/UDP
    #print (i.payload.payload.payload.load) #Raw
    print (hexdump(i,dump=True))
    s = hexdump(i,dump=True)
    print (type(s))
    ss = s.split("\n")
    print (ss)
    s = str(i)
    print (type(s))
    for i in s:
        print (hex(ord(i))),
    print ()
    break




'''
Ethernet Layer -> dst:  02:42:ac:11:00:02
IPLayer -> version:  4
TCP/UDP -> sport:  54502
0000  02 42 AC 11 00 02 02 42 4F FB 72 DB 08 00 45 00  .B.....BO.r...E.
0010  00 3C 73 B5 40 00 40 06 6E E1 AC 11 00 01 AC 11  .<s.@.@.n.......
0020  00 02 D4 E6 1B 59 E9 DF DE 95 00 00 00 00 A0 02  .....Y..........
0030  72 10 58 54 00 00 02 04 05 B4 04 02 08 0A 00 28  r.XT...........(
0040  AD 20 00 00 00 00 01 03 03 07                    . ........
<type 'str'>
['0000  02 42 AC 11 00 02 02 42 4F FB 72 DB 08 00 45 00  .B.....BO.r...E.', '0010  00 3C 73 B5 40 00 40 06 6E E1 AC 11 00 01 AC 11  .<s.@.@.n.......', '0020  00 02 D4 E6 1B 59 E9 DF DE 95 00 00 00 00 A0 02  .....Y..........', '0030  72 10 58 54 00 00 02 04 05 B4 04 02 08 0A 00 28  r.XT...........(', '0040  AD 20 00 00 00 00 01 03 03 07                    . ........']
<type 'str'>
0x2 0x42 0xac 0x11 0x0 0x2 0x2 0x42 0x4f 0xfb 0x72 0xdb 0x8 0x0 0x45 0x0 0x0 0x3c 0x73 0xb5 0x40 0x0 0x40 0x6 0x6e 0xe1 0xac 0x11 0x0 0x1 0xac 0x11 0x0 0x2 0xd4 0xe6 0x1b 0x59 0xe9 0xdf 0xde 0x95 0x0 0x0 0x0 0x0 0xa0 0x2 0x72 0x10 0x58 0x54 0x0 0x0 0x2 0x4 0x5 0xb4 0x4 0x2 0x8 0xa 0x0 0x28 0xad 0x20 0x0 0x0 0x0 0x0 0x1 0x3 0x3 0x7 ()




###[ Ethernet ]###
  dst       = 02:42:ac:11:00:02
  src       = 02:42:4f:fb:72:db
  type      = IPv4
###[ IP ]###
     version   = 4
     ihl       = 5
     tos       = 0x0
     len       = 60
     id        = 29621
     flags     = DF
     frag      = 0
     ttl       = 64
     proto     = tcp
     chksum    = 0x6ee1
     src       = 172.17.0.1
     dst       = 172.17.0.2
     \options   \
###[ TCP ]###
        sport     = 54502
        dport     = 7001
        seq       = 3923762837L
        ack       = 0
        dataofs   = 10
        reserved  = 0
        flags     = S
        window    = 29200
        chksum    = 0x5854
        urgptr    = 0
        options   = [('MSS', 1460), ('SAckOK', ''), ('Timestamp', (2665760, 0)), ('NOP', None), ('WScale', 7)]


Ethernet Layer -> dst:  02:42:ac:11:00:02
IPLayer -> version:  4
TCP/UDP -> sport:  54502


str(pkt)     组装数据包
hexdump(pkt)     十六进制转储
Is(pkt)     显示出字段值的列表
pkt.summary()     一行摘要
pkt.show()     针对数据包的展开
pkt.show2()     显示聚合的数据包
pkt.decode_payload_as()     改变decode方式
pkt.psdump()     绘制一个解释说明的PostScript图表
pkt.pdfdump()     绘制一个解释说明的PDF
pkt.command()     返回可以生成数据包的Scapy的命令
'''