python dpkt pcap如何获取协议？

Question

我有一个实验室，我需要为一个巨大的 pcap 文件的每个数据包找到协议。我打算制作一本字典来保存它们，但我的第一步只是使用 dpkt 提取信息。看起来 ip.get_proto 是我想要的，但我遗漏了一些要点。我正在阅读 http://www.commercialventvac.com/dpkt.html#mozTocId839997

#!/usr/bin/python
# -*- coding: utf-8 -*-

import dpkt
import socket
import sys
import datetime

import matplotlib.pyplot as ploot 
import numpy as arrayNum 
from collections import Counter 

packets = 0 

protocolDist = {}  

f = open('bob.pcap')
#f = open('trace1.pcap')
pcap = dpkt.pcap.Reader(f) 

print "Maj Version:  " , dpkt.pcap.PCAP_VERSION_MAJOR  
print "Min Version:  " , dpkt.pcap.PCAP_VERSION_MINOR 
print "Link Layer "    , pcap.datalink() 
print "Snap Len:    "  , pcap.snaplen 

# How many packets does the trace contain? Count timestamps

# iterate through packets, we get a timestamp (ts) and packet data buffer (buf)
for ts,buf in pcap:
    packets += 1
    eth = dpkt.ethernet.Ethernet(buf)
    ip = eth.data
  # what is the timestamp of the first packet in the trace?
    if packets == 1:
        first = ts 
        print "The first timestamp is %f " % (first)    
        print ip.get_proto
        break 

# What is the average packet rate? (packets/second)     
# The last time stamp
last = ts
print "The last timestamp is %f " % (ts) 
print "The total time is %f " % (last - first)
print "There are %d " % (packets)
#print "The packets/second %f " % (packets/(last-first))    


# what is the protocol distribution?
# use dictionary 

f.close()
sys.exit(0)

Answer 1

勾选ip.p 它returns一个数字对应的协议号。例如，UDP 有 17 个。不是检查

干杯

Answer 2

如果想获取ip协议号，可以使用

ip.get_proto(ip.p)

此辅助函数将协议编号转换为协议 class。查看 https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml 以获取 IP 协议的官方列表。有时以人类可读的格式获取表示形式很有用。我发现使用 __name__ 获取字符串很有用。

proto = ip.get_proto(ip.p).__name__
print(proto)
>>> 'TCP'

python dpkt pcap如何获取协议？

python dpkt pcap how to get protocol?

protocols

pcap

dpkt