I was thinking of analyzing and extracting wireless mark data (pcap) in python3, and I was able to confirm that I can list out UDP src, dsc and port in the script below. In addition to this, how do I specify (code) to get the value (yellow) like the one in the attachment? *I am not particular about the script below, so I look forward to hearing from you
#-*-coding:utf-8-*-
import dpkt, socket
import string
import binascii
import sys
# main function
defmain(filename):
pcr=dpkt.pcap.Reader(open(filename, 'rb')))
# Number of packets
packet_count = 0
# packet processing
forts, bufin pcr:
packet_count + = 1
try:
eth=dpkt.ethernet.Ethernet(buf)
except:
continue
# For IP data:
if type(eth.data) == dpkt.ip.IP:
ip=eth.data
ipheader (ip)
# TCP data
if type(ip.data) == dpkt.tcp.TCP:
tcp = ip.data
# Payload is not 0
iflen(tcp.data)!=0:
thex = binascii.b2a_hex(tcp.data)
payload (thex)
# UDP data
elif type (ip.data) == dpkt.udp.UDP:
udp = ip.data
# Payload is not 0
iflen(udp.data)!=0:
uhex=binascii.b2a_hex(udp.data)
payload(uhex)
# ICMP data
elif type (ip.data) == dpkt.icmp.ICMP:
icmp = ip.data
# Payload is not 0
iflen(icmp.data)!=0:
ihex=binascii.hexlify(str(icmp.data))
payload (ihex [8:])
print("End of process:", packet_count)
# IP header processing
def ipheader(header):
# Header Processing
src=socket.inet_ntoa(header.src)
dst=socket.inet_ntoa(header.dst)
if type(header.data) == dpkt.udp.UDP:
print("UDP%s:%s=>%s:%s(len:%s)"%(src,header.data.sport,dst,header.data.dport,len(header.data.data)))
# payload
def payload (thex):
# Payload Processing
return
/////////////////_/
Additional
It's not a smart method, but based on current know-how...
For now
in "wireshark→json data (save)→python analysis"
We decided to address the immediate challenge
Both BACpypes and tshark would like to deepen their understanding and use it as a future method
The wireshark ships with the CLI version of tshark
.
If you add the -V
option, the analysis results of the packet (similar to wireshark) will be output, so you can also extract the field value you want (using regular expressions, etc.).
[Example command to load and display PCAP files]
tshark-r PCAP file-V
What do you think?
Can the dpkt
library interpret BACnet packets?
Protocols that the library does not support must interpret the contents of the payload according to the protocol.
© 2024 OneMinuteCode. All rights reserved.