CODEWITHSUNDEEP
pythonofflinescapypacket
Jarosław Wieczorek
Jarosław Wieczorek

Reputation: 155

Getting a particular package from the pcap file using the Scapy module (python)

Is there a way to load a particular package from the pcap file using Scapy?

I know that I can load a specific number of packages using the' sniff' function and count attribute, e. g.' 

sniff(offline='file.pcap', prn=action, count=31)

However, I need to get a 30th packet without loading the previous packets. In other words, I am not satisfied with such an example:

packages = (pkt for pkt in sniff (offline=path, prn=action, count=31) 
print(packages[30])

The attempt to load a millionth of a package is too long.

Upvotes: 2

Views: 814

Answers (1)

MarkM
MarkM

Reputation: 857

Each packet header states how long it is. Once the parser has read that header, it can calculate the position of the next one. So as far as I know, you cannot open a pcap file and instantly locate packet 30; you'll need to parse the headers of the first 29.

But you don't have to keep all packets in memory either, as long as you process them while receiving.

i = 0
for pkt in sniff(offline=path, prn=action):
    if i == 30:
        print pkt
        break

Upvotes: 1

Related Questions