fd close(carved_images + now attempt face detection tryresult face_detect("% /% (pictures_directory,file_name),file_nameif result is truefaces_detected + exceptpass return carved_imagesfaces_detected carved_imagesfaces_detected http_assembler(pcap_fileprint "extracted% imagescarved_images print "detected% facesfaces_detected this is the main skeleton logic of our entire scriptand we will add in the supporting functions shortly to startwe open the pcap file for processing we take advantage of beautiful feature of scapy to automatically separate each tcp session into dictionary we use that and filter out only http trafficand then concatenate the payload of all of the http traffic into single buffer this is effectively the same as right-clicking in wireshark and selecting follow tcp stream after we have the http data reassembledwe pass it off to our http header parsing function which will allow us to inspect the http headers individually after we validate that we are receiving an image back in an http responsewe extract the raw image and return the image type and the binary body of the image itself this is not bulletproof image extraction routinebut as you'll seeit works amazingly well we store the extracted image and then pass the file path along to our facial detection routine now let' create the supporting functions by adding the following code above our http_assembler function def get_http_headers(http_payload)trysplit the headers off if it is http traffic headers_raw http_payload[:http_payload index("\ \ \ \ ")+ break out the headers headers dict(re findall( "(? *?)(? *?)\ \ "headers_raw)exceptreturn none if "content-typenot in headersreturn none return headers def extract_image(headers,http_payload)image none image_type none tryif "imagein headers['content-type']