dpkt 简单应用

import dpkt
from dpkt.utils import mac_to_str,inet_to_str
cap=f'D:/test_pacp/6.pcap'
with open(cap,'rb') as f:
    pcap = dpkt.pcap.Reader(f)
    for timestamp, buf in pcap:
        print('Timestamp: ', str(datetime.datetime.utcfromtimestamp(timestamp)))
        eth = dpkt.ethernet.Ethernet(buf)
　　　　　print(mac_to_str(eth.dst))  #目的mac
        eth.pprint()
        break  #解析一个包，json字典格式取值

#打印结果如下：

64:3f:5f:02:01:3d

Timestamp: 2020-08-24 05:57:17.676718

Ethernet(
dst=b'd?_\x02\x01=', # 64:3f:5f:02:01:3d
src=b'd?_\x01\x1fR', # 64:3f:5f:01:1f:52
type=2048,
data=IP(
v=4,
hl=5,
tos=0,
len=1500,
id=24492,
rf=0,
df=1,
mf=0,
offset=0,
ttl=64,
p=6, # TCP
sum=19969, # 0x4e01
src=b'\xc0\xa8\x03\x14', # 192.168.3.20
dst=b'\xc0\xa8\x03\n', # 192.168.3.10
opts=b'',
data=TCP(
sport=20161,
dport=46518,
seq=4246601815,
ack=2953433512,
off=5,
flags=16, # ACK
win=2667,
sum=57759, # 0xe19f
urp=0,
opts=b'',
data=b'8=STEP.1.0.0\x019=8543\x0135=UA3201\x0149=TEST\x0156=TEST\x0134=0\x0152=20200824-13:57:17\x0110142=7\x0110072=61228\x0150=2\x0195=8454\x0196=_\xfc\x19\x81\x01 9\x8a\x8160081\xb

.........

'
) # TCP
) # IP
) # Ethernet

#参考资料 https : //github.com/kbandla/dpkt/blob/master/examples/print_packets.py