Using Python to Read and Print Out a PCAP

user_13524305 0
Viewed 305

This is for a school assignment Relatively new to Python, and need some help. I'm required to read a PCAP file, and print out the source and destination IP's to a new file. I'm not allowed to use regex, I can't read the whole file at once, and I must use loops, functions (must accept one parameter and return a value), splits, and lists and IPs are in IPv4 format.

Are classes too complex for this problem? EDIT: Where I am so far is below: The search performed below is pulling the wrong IPs. I was advised to search by find the No. Time Source Destination Protocol

and then print the IPs from the line underneath it. I'm working on how to filter based on XXX.XXX.XXX format and will let you know how it goes :) 

def pcapreader():

#open the file and print each line using readlines to a variable
#must replace file path with your present file location


    with open (r"filepath", "r") as f:
        f1=f.readlines()
        for x in f1:
            if "Internet Protocol Version 4, Src:" in x:
                ips = x.split("Src: ")[1].split(",")
                src = ips[0]
                dst = ips[1].split("Dst: ")[1]
                print("Src: {}\nDst:{}".format(src, dst))

    f.close()

def main ():

        pcapreader()


main()

I've attached a sample of the PCAP I need to read as well.enter image description here

Any help would be appreciated! Thanks so much! :)

pcap python-3.x
1 Answers

One of the lines you read will contain Internet Protocol Version 4, Src: then the source followed by the destination.

So, for that line you can do the following:

>>> ips = "Internet Protocol Version 4, Src: 192.168.1.180, Dst: 239.255.255.250"
>>> ips = ip.split("Src: ")[1].split(",")
>>> ips
['192.168.1.180', ' Dst: 239.255.255.250']
>>> src = ips[0]
>>> dst = ips[1].split("Dst: ")[1]
>>> src
'192.168.1.180'
>>> dst
'239.255.255.250'

That line is named ips in the example, then source and destination extracted from it.

EDIT:

You can apply it in your code like this:

with open (r"filepath", "r") as f:
    f1=f.readlines()
    for x in f1:
      if "Internet Protocol Version 4, Src:" in x:
        ips = x.split("Src: ")[1].split(",")
        src = ips[0]
        dst = ips[1].split("Dst: ")[1]
        print("Src: {}\nDst:{}".format(src, dst))
        break

Hope this will help you.

ADD: For the last edit, if you want the data from the line below the Time Source ... you can do the following:

with open (r"filepath", "r") as f:
    f1=f.readlines()
    flag = False
    for x in f1:
      if "No.\tTime\tSource" in x:
        flag = True
        continue

      if flag:# This will be executed just at the line after No.\tTime\tSource...
        src = x.split("\t")[3]
        dst = x.split("\t")[4]
        print("Src: {}\nDst: {}".format(src, dst))
        flag = False

Note: I assumed that between each string will be \t, if it doesn't worked then you have maybe to add some spaces or do something like this

Another note: while you are using with statement to open the file, you don't need to try to close that file, it will be closed automatically. You can see this article for more information

user_94348380
Related