Filter pcap pap protocol without pyshark

Question

I want to access data in pap packets, currently i'm using pyshark with the following code

import pyshark,sys

cap = pyshark.FileCapture('test.pcap',display_filter='ppp && not ppp.length')

for packet in cap:
        if packet.pap.get_field_value('peer_id'):
            print ('user: '+packet.pap.peer_id+" logged in")

and it works fine on my pc and raspberrypi unfortunately i want to use this code on openwrt/lede router on which pyshark can't be installed due to ccache error:

unable to execute 'ccache_cc': no such file or directory

which i assumed that openwrt lacks some compiler features so I tried to install other pcap parsing libraries and could install scapy, dpkt and pypcapfile and they all installed fine so how can I convert my code to use one of these libraries

Pierre · Answer 1 · 2017-12-05T16:18:55.700

0

With Scapy (use the development version from GitHub), you can try:

from scapy.all import PcapReader, PPP_PAP_Request

for pkt in PcapReader('test.pcap'):
    if PPP_PAP_Request in pkt:
        print(pkt.sprintf('user: %PPP_PAP_Request.username% logged in'))

edited Dec 05 '17 at 16:18

answered Dec 04 '17 at 09:31

Pierre

6,047
1
30
49

This didn't work for me, I don't know why the packet is not detected as `PAP_PAP` instead it is detected as `PPP` only so i modified the code to this `from scapy.all import PcapReader, PPP_PAP,PPP for pkt in PcapReader('test.pcap'): if PPP in pkt: print(pkt) print(pkt.sprintf('user: %data% logged in')) ` and it worked except that it doesn't print the username only, it print the entire data (username with some byte data) – MOHAMMAD RASIM Dec 04 '17 at 22:31

MOHAMMAD RASIM · Answer 2 · 2017-12-05T08:16:07.240

Thanks to @pierre I found out that the development version of scapy has some new usefull classes (PPP_PAP and PPP_PAP_Request) so I was able to write a working code for my problem and it works in python2 and python3

from scapy.all import PPP,PPP_PAP_Request,sniff

def logusers(pkt):
        if PPP_PAP_Request in pkt:
                print(pkt[PPP_PAP_Request].username.decode()+" logged in")
sniff(count=0,offline='all.pcap',prn=logusers,filter="pppoes",store=0)

I used sniff function because i found it a bit lightweight and fast(i'm trying to run the code on an embedded system after all) But nevertheless it's still a bit slow and i don't know if there is something faster (maybe other than scapy) so i'm not going to accept this answer for a while

Filter pcap pap protocol without pyshark

2 Answers2