0

I'm new to Python. I'm reading pcap file using scapy, i want to fetch dport number by specifying particular ip addresses, I have something like below

from scapy.all import *
pkts = rdpcap('example.pcap')


for pkt in pkts:
    if IP in pkt:
        ip_src=pkt[IP].src
        ip_dst=pkt[IP].dst
    if TCP in pkt:
        tcp_sport=pkt[TCP].sport
        tcp_dport=pkt[TCP].dport
        print " IP src " + str(ip_src) + " TCP sport " + str(tcp_sport) 
        print " IP dst " + str(ip_dst) + " TCP dport " + str(tcp_dport)
        if ( ( pkt[IP].src == "10.116.206.114") or ( pkt[IP].dst == "10.236.138.184") ):
            print("!")

pcap file

enter image description here

required output

enter image description here

here in the above code i'm getting both results as shown below

IP src 10.116.206.114 TCP dport 443
IP dst 10.236.138.184 TCP dport 443
----
IP src 10.236.138.184 TCP dport 12516
IP dst 10.116.206.114 TCP dport 12516
.
.

so on, but i want only with specific src and dst ip which i specify like below i dont want both dport numbers.

IP src 10.116.206.114 TCP dport 443
IP dst 10.236.138.184 TCP dport 443
----
IP src 10.116.206.114 TCP dport 22
IP dst 10.236.138.184 TCP dport 22

Please suggest a method and explain how to fetch dport number from specific ip address. Thank you!

Darshan Mahalinge Gowda
  • 174
  • 7
  • 1
    Voting to close as it's more regarding finding a [library](https://pypi.org/project/python-libpcap/) to read pacaps rather than how to solve a particular problem. – Torxed Jun 08 '20 at 13:21
  • i edited the script please check once @Torxed – Darshan Mahalinge Gowda Jun 08 '20 at 16:31
  • And what's not working? (Also, I fixed an indentation issue with `print("!")` as it seamed to have jumped out of your if-block. But please elaborate what isn't working, because it looks like you've correctly accessed all the information you need except for the `Protocol` part. But there's still nothing wrong in the question. – Torxed Jun 08 '20 at 16:42
  • See in my code its giving out both the src and dst with ip addreses and vise versa but i need only one which i specify and thanks for the info @Torxed – Darshan Mahalinge Gowda Jun 08 '20 at 17:25

0 Answers0