Loop through pyshark's FileCapture object stops working

Question

I am reading a pcap file I have acquired with tcpdump. The pcap file is ~500MB. I read the file with FileCapture() and then I want to loop through each packet to extract the TLS payload. When I create the FileCapture object I also use override_prefs={'tls.keylog_file': os.path.abspath('tlsKey') where tlsKey is the file with the master keys to decrypt the file. The decryption works just fine, I can extract all the information from each single packet. However, if I want to loop through each packet and extract some information, the loop stops working at the packet for which packet.number = 258. My file contains more than 258 packets. What is going on?

My code

import pyshark
import os
cap = pyshark.FileCapture('traffic.pcap')
for packet in cap:
    print(packet.number)
    if "IP" in packet:
        print(packet)
print('Finished')

the last output I get is here. As you can see, the layer TLS does not get printed. Why?

Expected behavior

I would expect my script to print Finished at the end, but it doesn't. The for loop looks stuck. Since the pcap file is large I cannot attach it. Any explanation of what's happening?

Versions (please complete the following information):

OS: MacOS 13.1
pyshark version: 0.5.3
tshark version: TShark (Wireshark) 4.0.2 (v4.0.2-0-g415456d13370)

Loop through pyshark's FileCapture object stops working

0 Answers0