Pulling data from pyshark

user_14627244 0
Viewed 1155

I am trying to pull data out of data packets that I am recieving from another device. I have isolated the packet I want to pull the data from but cannot figure out how to extract the data that I want. I am using pyshark to get to the packet but this does not allow to me to actually see that data. I can see the data when I am in wireshark. The data I am looking to pull is circled in red. Wireshark

Here is my code in python.

import pyshark

capture=pyshark.LiveCapture(interface='wlan0', display_filter='frame.len>190 and upd.port==1700')

for i in capture:
  print(i)

Which displays all of the same information that wireshark does minus the latitude, longitude coordinates.

pyshark packet wireshark python
1 Answers

I would ask for a sample PCAP file, but most people don't want to share real world data. Without a PCAP file, I cannot give you a complete answer, but I can give you one that is 95% there.

This is the way that I would attack your problem:

import pyshark

capture = pyshark.LiveCapture(interface='your_interface')
for raw_packet in capture.sniff_continuously():

   # filter only UDP packet that have a frame length greater 
   # than 190 and that have a port number of 1700.
   if hasattr(raw_packet, 'udp') and int(packet.frame_info.cap_len) > 190 and packet[packet.transport_layer].srcport == '1700':

     # Get the details for the packets by accessing
     # _all_fields and _all_fields.values()
     field_names = raw_packet.udp._all_fields
     field_values = raw_packet.udp._all_fields.values()
     for field_name in field_names:
        for field_value in field_values:
           # you can add another filter here to get your 
           # lat & long coordinates 
           print(f'{field_name} -- {field_value}')

     # if you need to access the packet data you need to do this,
     # but it might come back in hex, which will need to be decoded. 
     # if "DATA" in str(packet.layers):
     #   print(packet.data.data)

Please reach out if you have any issues filtering out the packets that you're looking for. if you can share a sample PCAP, I will tweak my answer.

I have a document and code examples on GitHub named pyshark packet analysis that you might find useful.

user_60834230
Related