CODEWITHSUNDEEP
pythonpyshark
bylds
bylds

Reputation: 77

Accessing LayerFieldsContainer using variable in pyshark

I'm using pyshark to parse pcap files. I want to access layer fields using variable as shown in simple example below:
For example to access ntp server ip: 

p = cap[0]
print(p.bootp.option_ntp_server)

However, I want to access it like this: 

option_list = {
    "12": "option_hostname",
    "60": "option_vendor_class_id",
    "43": "option_ntp_server"
    }

p = cap[0]
print(p.bootp.%s %(option_list["43"]))

Of course this kind of access is not possible. So I tried to use getattr() like this:

getOption = getattr(p.bootp, option_list["43"])
getOption()

And it gave me following error:

'LayerFieldsContainer' object is not callable

It seems pyshark packet or layer classes is not callable.

How I can access layer fields using variable? Or can you suggest me another method to access options using option type numbers? Because I want to access this fields using option type numbers (Like option 12, option 43), not using titles.

Upvotes: 0

Views: 2829

Answers (1)

langiac
langiac

Reputation: 347

i think OBJ pyshark.packet.fields.LayerFieldsContainer have format special, you can't use it as string. dir (LayerFieldsContaniner) have: 

['__add__', '__class__', '__class__', '__contains__', '__delattr__', '__delattr__', '__dict__', '__dir__', '__doc__', '__doc__', '__eq__', '__format__', '__format__', '__ge__', '__getattr__', '__getattribute__', '__getattribute__', '__getitem__', '__getnewargs__', '__getslice__', '__getstate__', '__getstate__', '__gt__', '__hash__', '__hash__', '__init__', '__init__', '__le__', '__len__', '__lt__', '__mod__', '__module__', '__module__', '__mul__', '__ne__', '__new__', '__new__', '__reduce__', '__reduce__', '__reduce_ex__', '__reduce_ex__', '__repr__', '__repr__', '__rmod__', '__rmul__', '__setattr__', '__setattr__', '__setstate__', '__setstate__', '__sizeof__', '__sizeof__', '__slots__', '__str__', '__str__', '__subclasshook__', '__subclasshook__', '__weakref__', '_formatter_field_name_split', '_formatter_parser', 'add_field', 'all_fields', 'alternate_fields', 'base16_value', 'binary_value', 'capitalize', 'center', 'count', 'decode', 'encode', 'endswith', 'expandtabs', 'fields', 'find', 'format', 'get_default_value', 'hex_value', 'hide', 'index', 'int_value', 'isalnum', 'isalpha', 'isdigit', 'islower', 'isspace', 'istitle', 'isupper', 'join', 'ljust', 'lower', 'lstrip', 'main_field', 'name', 'partition', 'pos', 'raw_value', 'replace', 'rfind', 'rindex', 'rjust', 'rpartition', 'rsplit', 'rstrip', 'show', 'showname', 'showname_key', 'showname_value', 'size', 'split', 'splitlines', 'startswith', 'strip', 'swapcase', 'title', 'translate', 'unmaskedvalue', 'upper', 'zfill']

you can use it.

Upvotes: 1

Related Questions