pyshark Cannot access data regarding packet

Question

I am trying to convert a .pcap file into an CSV file using PyShark. I want to print all of the data about the first packet of my pcap file.

Code

import pyshark
cap = pyshark.FileCapture('test.pcap')
print(cap[0])

Error

ValueError: I/O operation on closed pipe

Error Stack Trace

    Fatal read error on pipe transport
protocol: <ReadSubprocessPipeProto fd=1 pipe=<_ProactorReadPipeTransport fd=572>>
transport: <_ProactorReadPipeTransport fd=572>
Traceback (most recent call last):
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 274, in _loop_reading
    self._read_fut = self._loop._proactor.recv(self._sock, 32768)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_events.py", line 416, in recv
    self._register_with_iocp(conn)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_events.py", line 641, in _register_with_iocp
    _overlapped.CreateIoCompletionPort(obj.fileno(), self._iocp, 0, 0)
OSError: [WinError 87] The parameter is incorrect
Exception in callback _ProactorReadPipeTransport._loop_reading(<_OverlappedF...t" size="1" '>)
handle: <Handle _ProactorReadPipeTransport._loop_reading(<_OverlappedF...t" size="1" '>)>
Traceback (most recent call last):
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 274, in _loop_reading
    self._read_fut = self._loop._proactor.recv(self._sock, 32768)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_events.py", line 416, in recv
    self._register_with_iocp(conn)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_events.py", line 641, in _register_with_iocp
    _overlapped.CreateIoCompletionPort(obj.fileno(), self._iocp, 0, 0)
OSError: [WinError 87] The parameter is incorrect

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\events.py", line 88, in _run
    self._context.run(self._callback, *self._args)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 284, in _loop_reading
    self._fatal_error(exc, 'Fatal read error on pipe transport')
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 110, in _fatal_error
    self._force_close(exc)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 113, in _force_close
    if self._empty_waiter is not None:
AttributeError: '_ProactorReadPipeTransport' object has no attribute '_empty_waiter'
Exception ignored in: <function BaseSubprocessTransport.__del__ at 0x02F17588>
Traceback (most recent call last):
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\base_subprocess.py", line 125, in __del__
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\base_subprocess.py", line 78, in __repr__
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 57, in __repr__
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_utils.py", line 102, in fileno
ValueError: I/O operation on closed pipe
Exception ignored in: <function _ProactorBasePipeTransport.__del__ at 0x02F1F930>
Traceback (most recent call last):
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 93, in __del__
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 57, in __repr__
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_utils.py", line 102, in fileno
ValueError: I/O operation on closed pipe

Here is the packet in WireShark.

And the accompanying Frame data

Any help in resolving this error is much appreciated.

score 2 · Answer 1 · edited Dec 25 '21 at 15:17

2

I encountered the same issue, and it's resolved by invoking close() function.

import pyshark
cap = pyshark.FileCapture('test.pcap')
print(cap[0])
cap.close()

edited Dec 25 '21 at 15:17

cigien

57,834
11
73
112

answered Dec 22 '21 at 02:31

DonnieS

21
2

score 0 · Answer 2 · answered Aug 31 '20 at 12:58

I took a look into the documentation: https://kiminewt.github.io/pyshark/ and it seems pretty straightforward as you used it.

Also took a look at the open issues and did not found anything related.

I suggest to try with a different capture (maybe a .cap) and if you have the same error.

I would say it's related to the following bug: https://bugs.python.org/msg374758.

You can try mptcpanalyzer as an alternative

# the script will try to generate a csv file
$ mptcpanalyzer --load test.pcap

pyshark Cannot access data regarding packet

2 Answers2