python - 在 python 上使用 scapy 显示捕获并保存在 .pcap 中的数据包协议(protocol)

Question

我正在捕获实时空中 WiFi 流量并将捕获的数据包仅 header 保存在 .pcap 文件中。是否可以找出整个捕获过程中使用了哪些协议(protocol)？如果是，我如何跟踪找到的每个协议(protocol)下的数据包数量？

我找到了很多关于使用 Scapy 注入(inject)数据包的信息，但没有找到关于分析的信息。

到目前为止我已经尝试过:

from scapy.all import * # import scapy package
from scapy.utils import rdpcap # import module for loading pcaps
pkts = rdpcap("./traffic/capture20131120-001.pcap") # load pcap
pkts.summary(lambda(r): r.sprintf("%Dot11.proto%")) # protocol?
print -(256-ord(pkts[24].notdecoded[-4:-3])) # signal strength of packet 24

似乎 pkts.summary(lambda(r): r.sprintf("%Dot11.proto%")) 返回 0L 我不明白.

Answer 1

目前，Scapy 不支持很多协议(protocol)，因此它适用于某些任务，但不适用于其他任务。改用 pyshark(Wireshark 的 Python 包装器)，还有更多受支持的协议(protocol)。

---

使用 Scapy:

from scapy.all import *

def process_with_scapy(fileName):
    protocol_count = {}

    pcap_data = rdpcap(fileName)
    sessions = pcap_data.sessions()
    for session in sessions:
        for packet in sessions[session]:
            for i in range(len(packet.layers())):
                layer = packet.getlayer(i)
                protocol = layer.name

                # Count the number of occurences for each protocol type
                if protocol not in protocol_count: protocol_count[protocol] = 1
                else: protocol_count[protocol] += 1

    # Sort the dictionary in descending order
    protocol_count = dict(sorted(protocol_count.items(), key=lambda item: item[1], reverse=True))
    
    # Print the output
    for protocol in protocol_count:
        print(f'{protocol_count[protocol]} packets have layer "{protocol}"')

process_with_scapy('./traffic/capture20131120-001.pcap')

文档: https://readthedocs.org/projects/scapy/downloads/pdf/latest

---

使用 PyShark(更慢但更受支持):

import pyshark

def process_with_pyshark(fileName):
    protocol_count = {}

    pcap_data = pyshark.FileCapture(fileName)
    for packet in pcap_data:
        for layer in packet:
            protocol = layer.layer_name

            # Count the number of occurences for each protocol type
            if protocol not in protocol_count: protocol_count[protocol] = 1
            else: protocol_count[protocol] += 1

    # Sort the dictionary in descending order
    protocol_count = dict(sorted(protocol_count.items(), key=lambda item: item[1], reverse=True))

    # Print the output
    for protocol in protocol_count:
        print(f'{protocol_count[protocol]} packets have layer "{protocol}"')


process_with_pyshark('./traffic/capture20131120-001.pcap')

• 有关特定协议(protocol)的信息: https://www.wireshark.org/docs/dfref/
• 特定协议(protocol)解析器的源代码有时也很有用: https://github.com/wireshark/wireshark/tree/master/epan/dissectors