pcap file viewing library in python 3
Question: I'm looking at trying to read pcap files from various CTF events.

Ideally, I would like something that can do the breakdown of information such
as wireshark, but just being able to read the timestamp and return the packet
as a bytestring of some kind would be welcome.

The problem is that there is little or no python 3 support with all the
commonly cited libraries: dpkt, pylibpcap, pcapy, etc.

Does anyone know of a pcap library that works with python 3?


Answer: to my knowledge, there are at least 2 packages that seems to work with Python
3: **`pure-pcapfile`** and **`dpkt`** :

  * `pure-pcapfile` is easy to install in python 3 using `pip`. It's very easy to use but still limited to decoding **Ethernet** and **IP** data. The rest is left to you. But it works right _out of the box_.
  * `dpkt` doesn't work right _out of the box_ and needs some manipulation before. They are porting it to Python 3 and plan to have a Python 2 and 3 compatible version for version 2.0. Unfortunately, it's not there yet. However, it is way more complete than `pure-pcapfile` and can decode many protocols. If your packet embeds several layers of protocols, it will decode them automatically for you. The only problem is that you need to make a few corrections here and there to make it work (as the time of writing this comment).

## pure-pcapfile

the only one that I found working for Python 3 so far is pcapfile. You can
find it at <https://pypi.python.org/pypi/pypcapfile/> or install it by doing
`pip3 install pypcapfile`.

There are just basic functionalities but it works very well for me and has
been updated quite recently (at the time of writing this message):

    
    
    from pcapfile import savefile
    file = open('mypcapfile.pcp' , 'rb')
    pcapfile = savefile.load_savefile(f,verbose=True)
    

If everything goes well, you should see something like this:

    
    
    [+] attempting to load mypcapfile.pcap
    [+] found valid header
    [+] loaded 1234 packets
    [+] finished loading savefile.
    

A few remarks now. I'm using Python 3.4.3. And doing `import pcapfile` will
not import anything from it (I'm still a beginner with Python) but the only
basic information and functions from the package. Next, you have to explicitly
open your file in binary mode by passing `'rb'` as the mode in the `open()`
function. In the documentation they don't say it explicitly.

The rest is like in the documentation:

    
    
    packet = pcapfile.packets[12]
    

to access the packet number 12 (the 13th packet then, the first one being at
0). And you have basic functionalities like

    
    
    packet.timestamp
    

to get a timestamp or

    
    
    packet.raw()
    

to get raw data.

The documentation mentions functions to do packet decoding of some standard
formats like _Ethernet_ and _IP_.

## dpkt

`dpkt` is not available for Python 3 so you need to do the following, assuming
you have access to a command line. The code is available on
<https://github.com/kbandla/dpkt.git> and you must download it before:

    
    
    git clone https://github.com/kbandla/dpkt.git
    cd dpkt
    git checkout --track origin/migrate_py3
    git pull
    

This 4 commands do the following:

  1. clone (download) the code from its git repository on github
  2. go into the newly created directory named `dpkt`
  3. switch to the branch name `migrate_py3` which contains the Python 3 code. As you can see from the name of this branch, it's still experimental. So far it works for me.
  4. (just in case) download again the code

then copy the directory named `dpkt` in your project or wherever Python 3 can
find it.

Later on, in Python 3 here is what you have to do to get started:

    
    
    import dpkt
    file = open('mypcapfile.pcap','rb')
    

will open your file. Don't forget the `'rb'` binary mode in Python 3 (same
thing as in `pure-pcapfile`).

    
    
    pcap = dpkt.pcap.Reader(file)
    

will read and decode your `file`

    
    
    for ts, buf in pcap:
        eth = dpkt.ethernet.Ethernet(buf)
        print(eth)
    

will, for example, decode Ethernet packet and print them. Then read the
documentation on how to use `dpkt`. If your packets contain IP or TCP layer,
then `dpkt.ethernet.Ethernet(buf)` will decode them as well. Also note that in
the `for` loop, we have access to the timestamps in `ts`.

You may want to iterate it in a less constrained form and doing as follows
will help:

    
    
    (ts,buf) = next(pcap)
    eth = dpkt.ethernet.Ethernet(buf)
    

where the first line get the next tuple from the pcap file. If pcap is `False`
then you read everything.

