Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!news.albasani.net!nntp-feed.chiark.greenend.org.uk!ewrotcd!news.nosignal.org!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail
Return-Path: <d@davea.name>
X-Original-To: python-list@python.org
Delivered-To: python-list@mail.python.org
X-Spam-Status: OK 0.009
X-Spam-Evidence: '*H*': 0.98; '*S*': 0.00; 'url:pypi': 0.03; 'output': 0.04; 'subject:file': 0.07; 'python': 0.09; 'https': 0.09; 'files.': 0.13; 'pairs': 0.16; 'sure.': 0.16; 'wrote:': 0.17; 'http': 0.22; 'parse': 0.22; 'kevin': 0.23; 'script': 0.24; 'header:In-Reply-To:1': 0.25; 'header:User-Agent:1': 0.26; 'run': 0.28; 'url:python': 0.32; 'file': 0.32; 'extract': 0.33; 'to:addr :python-list': 0.33; 'pm,': 0.35; 'there': 0.35; 'but': 0.36; 'url:org': 0.36; 'why': 0.37; 'subject:: ': 0.38; 'some': 0.38; 'instead': 0.39; 'to:addr:python.org': 0.39; 'received:192': 0.39; 'received:192.168': 0.40; 'traffic': 0.61; 'received:74.208': 0.71; 'hoping': 0.72; 'illustrated': 0.84
Date: Tue, 22 Jan 2013 22:03:46 -0500
From: Dave Angel <d@davea.name>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130106 Thunderbird/17.0.2
MIME-Version: 1.0
To: python-list@python.org
Subject: Re: Parse a Wireshark pcap file
References: <CAN4UfGzwzHJvpY=Er2B2otZMBm=8eVA6FDGejJbirXLZFTXvsg@mail.gmail.com>
In-Reply-To: <CAN4UfGzwzHJvpY=Er2B2otZMBm=8eVA6FDGejJbirXLZFTXvsg@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V02:K0:KzVsPrdfp+ui4pB27uvOWjwqN61cJOERpZY6rBlQ8g9 x8CCVIDptThh2ye+ifrpx6SjRgShhcbpILZAnVdwN1EfboJPgW UOQv/3eFWYuAaHauMXD9KdRem+iXZJN/rkglxO8lnFqupYgATg 5wmTCSB4OY8cFKNLuressG1W7l4P1bDiWokMsiitnc7jUYfSqG oqMjilA6zwZcgtBLLfSeuGwi8wojAqxS0tYIyrb5yKsBuBj5g/ +KNnLaOms0Gf5375krXm/OHZaVMLGb7YJFTMuNbe1Xi6GeX9rd pX9c7m940wKW+DE8IbeFIYjBvr9xk/KryVvNk8nMW9m2/Asyw= =
X-BeenThere: python-list@python.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: General discussion list for the Python programming language <python-list.python.org>
List-Unsubscribe: <http://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe>
List-Archive: <http://mail.python.org/pipermail/python-list/>
List-Post: <mailto:python-list@python.org>
List-Help: <mailto:python-list-request@python.org?subject=help>
List-Subscribe: <http://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe>
Newsgroups: comp.lang.python
Message-ID: <mailman.854.1358910253.2939.python-list@python.org>
Lines: 15
NNTP-Posting-Host: 2001:888:2000:d::a6
X-Trace: 1358910253 news.xs4all.nl 6859 [2001:888:2000:d::a6]:54235
X-Complaints-To: abuse@xs4all.nl
Xref: csiph.com comp.lang.python:37403

On 01/22/2013 08:32 PM, Kevin Holleran wrote:
> Is there a way to parse out a wireshark pcap file and extract key value
> pairs from the data?  I am illustrated a sniff of some traffic and why it
> needs utilize HTTPS instead of HTTP but I was hoping to run the pcap
> through a python script and just output some interesting key value
> pairs....
>

Sure.  scapy can create and/or parse pcap files.

http://pypi.python.org/pypi/Scapy


-- 
DaveA