0

I am trying to get the snapshot length of a .pcap file. I have gone to the man page for pcap and pcap_snapshot but have not been able to get the function to work.

I am running a VM Fedora20 and it is written in python

First I try to import the file that the man page says to include but I get a syntax error on the import and the pcap_snapshot() I am new at python so I imagine its something simple but not sure what it is. Any help is much appreciated! 

import <pcap/pcap.h>
import dpkt

myPcap = open('mycapture.pcap')
myFile = dpkt.pcap.Reader(myPcap)

print "Snapshot length = ", myFile.pcap_snapshot()
John
  • 89
  • 3
  • 16

1 Answers1

1

Don't read the man page first unless you're writing code in C, C++, or Objective-C.

If you're not using a C-flavored language, you'll need to use a wrapper for libpcap, and should read the documentation for the wrapper first, as you won't be calling the C functions from libpcap, you'll be calling functions from the wrapper. If you try to import a C-language header file, such as pcap/pcap.h, in Python, that will not work. If you try to directly call a C-language function, such as pcap_snapshot(), that won't work, either.

Dpkt is not a wrapper; it is, instead, a library to parse packets and to read pcap files, with the code to read pcap files being independent of libpcap. Therefore, it won't offer wrappers for libpcap APIs such as pcap_snapshot().

Dpkt's documentation is, well, rather limited. A quick look at its pcap.py module seems to suggest that

print "Snapshot length = ", myFile.snaplen

would work; give that a try.