Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > comp.lang.python > #37403

Re: Parse a Wireshark pcap file

Path csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!news.albasani.net!nntp-feed.chiark.greenend.org.uk!ewrotcd!news.nosignal.org!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail
Return-Path <d@davea.name>
X-Original-To python-list@python.org
Delivered-To python-list@mail.python.org
X-Spam-Status OK 0.009
X-Spam-Evidence '*H*': 0.98; '*S*': 0.00; 'url:pypi': 0.03; 'output': 0.04; 'subject:file': 0.07; 'python': 0.09; 'https': 0.09; 'files.': 0.13; 'pairs': 0.16; 'sure.': 0.16; 'wrote:': 0.17; 'http': 0.22; 'parse': 0.22; 'kevin': 0.23; 'script': 0.24; 'header:In-Reply-To:1': 0.25; 'header:User-Agent:1': 0.26; 'run': 0.28; 'url:python': 0.32; 'file': 0.32; 'extract': 0.33; 'to:addr :python-list': 0.33; 'pm,': 0.35; 'there': 0.35; 'but': 0.36; 'url:org': 0.36; 'why': 0.37; 'subject:: ': 0.38; 'some': 0.38; 'instead': 0.39; 'to:addr:python.org': 0.39; 'received:192': 0.39; 'received:192.168': 0.40; 'traffic': 0.61; 'received:74.208': 0.71; 'hoping': 0.72; 'illustrated': 0.84
Date Tue, 22 Jan 2013 22:03:46 -0500
From Dave Angel <d@davea.name>
User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130106 Thunderbird/17.0.2
MIME-Version 1.0
To python-list@python.org
Subject Re: Parse a Wireshark pcap file
References <CAN4UfGzwzHJvpY=Er2B2otZMBm=8eVA6FDGejJbirXLZFTXvsg@mail.gmail.com>
In-Reply-To <CAN4UfGzwzHJvpY=Er2B2otZMBm=8eVA6FDGejJbirXLZFTXvsg@mail.gmail.com>
Content-Type text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding 7bit
X-Provags-ID V02:K0:KzVsPrdfp+ui4pB27uvOWjwqN61cJOERpZY6rBlQ8g9 x8CCVIDptThh2ye+ifrpx6SjRgShhcbpILZAnVdwN1EfboJPgW UOQv/3eFWYuAaHauMXD9KdRem+iXZJN/rkglxO8lnFqupYgATg 5wmTCSB4OY8cFKNLuressG1W7l4P1bDiWokMsiitnc7jUYfSqG oqMjilA6zwZcgtBLLfSeuGwi8wojAqxS0tYIyrb5yKsBuBj5g/ +KNnLaOms0Gf5375krXm/OHZaVMLGb7YJFTMuNbe1Xi6GeX9rd pX9c7m940wKW+DE8IbeFIYjBvr9xk/KryVvNk8nMW9m2/Asyw= =
X-BeenThere python-list@python.org
X-Mailman-Version 2.1.15
Precedence list
List-Id General discussion list for the Python programming language <python-list.python.org>
List-Unsubscribe <http://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe>
List-Archive <http://mail.python.org/pipermail/python-list/>
List-Post <mailto:python-list@python.org>
List-Help <mailto:python-list-request@python.org?subject=help>
List-Subscribe <http://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe>
Newsgroups comp.lang.python
Message-ID <mailman.854.1358910253.2939.python-list@python.org> (permalink)
Lines 15
NNTP-Posting-Host 2001:888:2000:d::a6
X-Trace 1358910253 news.xs4all.nl 6859 [2001:888:2000:d::a6]:54235
X-Complaints-To abuse@xs4all.nl
Xref csiph.com comp.lang.python:37403

Show key headers only | View raw


On 01/22/2013 08:32 PM, Kevin Holleran wrote:
> Is there a way to parse out a wireshark pcap file and extract key value
> pairs from the data?  I am illustrated a sniff of some traffic and why it
> needs utilize HTTPS instead of HTTP but I was hoping to run the pcap
> through a python script and just output some interesting key value
> pairs....
>

Sure.  scapy can create and/or parse pcap files.

http://pypi.python.org/pypi/Scapy


-- 
DaveA

Back to comp.lang.python | Previous | Next | Find similar | Unroll thread


Thread

Re: Parse a Wireshark pcap file Dave Angel <d@davea.name> - 2013-01-22 22:03 -0500

csiph-web