CODEWITHSUNDEEP
python-2.7scapypcap
Kashif Ahmad
Kashif Ahmad

Reputation: 486

Is there a way I can read packets from a pcap file into an array?

I am trying to build a new layer using scapy. I want to read a pcap file and store each packet in an array so that I can access all the information inside the packet using the index of the array.

Upvotes: 0

Views: 1476

Answers (2)

H3tz
H3tz

Reputation: 1

As you can read everywhere Scape is SUPER slow for pcap files >10MB. I made a couple of tools always using dpkt. Just to give you an idea. Having a 670MB file using dpkt splitting the specific bytes I need compared to full fletched scapy (reading raw packages (the fastest solution with scapy)) is:

dpkt needs 150s (6GB ram), scapy >750s (>10GB)

Upvotes: -1

StephenG
StephenG

Reputation: 2881

The scapy function that you're looking for is rdpcap

from scapy.all import *

packets = rdpcap('file.pcap')
packets[0].show()

Upvotes: 2

Related Questions