对wireshark所抓的包进行流量分析

直接上代码

from scapy.all import *
#需下载第三方库scapy

if __name__ == '__main__':
    pcap = rdpcap('./aim.pcap')  #wireshark所抓的包路径
    for item in pcap:
    #print(item.show())   按需求分析
    #if ('TCP' in item) and (item['TCP'].fields['dport'] == 80) and (item['IP'].fields['dst'] == '192.168.0.123'):
        if ('TCP' in item) and ('IP' in item):
            src = item['IP'].fields['src']
            dst = item['IP'].fields['dst']
            sport = item['TCP'].fields['sport']
            dport = item['TCP'].fields['dport']
    #这里对web服务器192.168.0.123的响应与请求全取出来，可自行更改
            if (src == '192.168.0.123' and sport == 80) or (dst == '192.168.0.123' and dport == 80):
                print(repr(item))