Grabbing multiple IPs from a PCAP file using dpkt

Question

I'm new to Python, and the dpkt module, and need some help. I've done as much research on this subject as I possibly could but to no avail. My manager wants me to create a program that parses PCAP files and writes IP addresses regardless of traffic type (HTTP, FTP, etc...) to a text file. I've figured out the basics (since a sample code is posted online) but I don't know how to parse beyond the first entry in a .pcap file.

The closest I got was trying to use the "zip" command, but that didn't work and I can't figure out how to get more than one IP printed out, it's frustrating to no end. Would anyone be able to give me any pointers? I'm not against using other modules such as scapy, if that makes this task easier.

score 0 · Answer 1 · answered Feb 17 '17 at 21:09

One way might be to use Scapy to read the .pcap and iterate over each packet and pull out their IP. Maybe like this:

from scapy.all import *

fob = rdpcap('test_pcap.pcap') 
cap = [] 

for pkt in fob:
    if pkt.haslayer(IP):
        if pkt[IP].src not in cap:
            cap.append(pkt[IP].src)

    if pkt.haslayer(ARP):
        if pkt[ARP].psrc not in cap:
            cap.append(pkt[ARP].psrc)

print(cap)

Grabbing multiple IPs from a PCAP file using dpkt

1 Answers1