CODEWITHSUNDEEP
pythonwiresharkpcapscapy
Brogrammer
Brogrammer

Reputation: 46

Strip radiotap headers from a pcap file

I am working on a project where I need to capture pcap files that contain a h264 video stream. I need to reconstruct the video from the packets. I found a tool called videosnarf that does just this but the problem is that the pcap files that I have captured contain a radiotap header which I need to strip before I can use the packets with videosnarf. Is there any way to strip the radiotap headers? If anyone could direct me to utility or python library that could be used to modify pcap files, it would be great! Thanks.

Upvotes: 0

Views: 2218

Answers (1)

Yoel
Yoel

Reputation: 9614

scapy is the python library you're looking for. You can read and write pcap files using rdpcap and wrpcap, as detailed in the official API documentation:

rdpcap(filename, count=-1)

reads a pcap file and returns the list of read packets. If count is positive, only the first count packets are read.

wrpcap(filename, pkt, linktype=None)

Write a packet or list of packets to a pcap file. linktype can be used to force the link type value written into the file.

Thus, code that strips the RadioTap header from a pcap file would be something along these lines:

from scapy.all import rdpcap, wrpcap

pkts = rdpcap('h264_file.pcap')
stripped_pkts = [pkt.payload for pkt in pkts] # strip the RadioTap header; extract just its payload
wrpcap('stripped_h264_file.pcap', stripped_pkts)

Upvotes: 1

Related Questions