首页 > 代码库 > Windows下使用scapy+python2.7实现对pcap文件的读写操作
Windows下使用scapy+python2.7实现对pcap文件的读写操作
scapy在linux环境中对pcap文件进行操作非常方便,但在windows下,特别是在python2.7环境下却会碰到各种各样的依赖包无法使用的问题,最明显的可能就属dnet和pcap的python依赖包了,因为scapy的conf.use_pcap和conf.use_dnet在windows环境下无法进行配置,在scapy\arch\windows\__init__.py中都被强行置为1了,也就是必须使用pcap和dnet依赖包。具体代码如下所示
from scapy.sendrecv import debug, srp1from scapy.layers.l2 import Ether, ARPfrom scapy.data import MTU, ETHER_BROADCAST, ETH_P_ARPconf.use_pcap = 1conf.use_dnet = 1from scapy.arch import pcapdnetfrom scapy.arch.pcapdnet import *LOOPBACK_NAME="lo0"WINDOWS = True
google了一遍,基本都是在Windos+python2.6的环境下使用scapy的,很少有使用Windows+python2.7的,几经周折,又cygwin又是MinGW的总算搞定dnet和pcap在Windows+python2.7的包。
具体下载地址为:
pcap http://files.cnblogs.com/Jerryshome/pcap-1.1.win32-py2.7.rar
dnet http://files.cnblogs.com/Jerryshome/dnet-1.12.win32-py2.7.rar
以下代码对如何使用scapy完成pcap的读写做了展示,同时为解决部分scapy解析出来的Packet无法序列化的问题提供一个PicklablePacket类,具体代码如下:
import scapyfrom scapy.all import *from scapy.utils import PcapReader, PcapWriterimport gzip,zlib,cPickleclass PicklablePacket: ‘‘‘ A container for scapy packets that can be pickled (in contrast to scapy pakcets themselves) ‘‘‘ def __init__(self, pkt): self.contents = str(pkt) self.time = pkt.time def __call__(self): ‘‘‘ Get the original scapy packet ‘‘‘ pkt = scapy.layers.l2.Ether(self.contents) pkt.time = self.time return pkt def dumps(self): ‘‘‘use cpickle to dump‘‘‘ return gzip.zlib.compress(cPickle.dumps(self)).encode(‘base64‘) @staticmethod def loads(string): ‘‘‘ load object from string ‘‘‘ p = cPickle.loads(gzip.zlib.decompress(string.decode(‘base64‘))) return p() def read(file_name, start, count): ‘‘‘ read packets from pcap according to the start packet number and total count ‘‘‘ reader = PcapReader(file_name) if start > 0: reader.read_all(start) if count > 0: return reader.read_all(count) else: return reader.read_all(-1)def write(file_name, packets): writer = PcapWriter(file_name, append = True) for p in packets: writer.write(p) writer.flush() writer.close()if __name__ == ‘__main__‘: packets = read(‘726445CD34B7273EBEA2973BBD6E784C.C39BC427.pcap‘, 0, 10) # packle the packets to transfer p = PicklablePacket(packets[0]) s = p.dumps() p = PicklablePacket.loads(s) print p print p.summary() serialized_packets = [PicklablePacket(p).dumps() for p in packets] deserialized_packets = [PicklablePacket.loads(s) for s in serialized_packets] write(‘new.pcap‘, packets)
Windows下使用scapy+python2.7实现对pcap文件的读写操作
声明:以上内容来自用户投稿及互联网公开渠道收集整理发布,本网站不拥有所有权,未作人工编辑处理,也不承担相关法律责任,若内容有误或涉及侵权可进行投诉: 投诉/举报 工作人员会在5个工作日内联系你,一经查实,本站将立刻删除涉嫌侵权内容。