How to parse Ethernet Header of pcap file using Python?
Question: I would like to decode the link-layer type and version of packets in a pcap
file using Python. So, I have to parse pcap using Python. Here is my code.

    
    
    import dpkt
    import socket
    import sys
    
    f = open('filename')
    pcap = dpkt.pcap.Reader(f)
    
    for ts, buf in pcap:
      eth = dpkt.ethernet.Ethernet(buf)
      ip = eth.data
      tcp = ip.data
        print ts, len(buf)
        print eth
        print ip
        print tcp
    
    f.close() 
    


Answer: The [dpkt](https://code.google.com/p/dpkt/) python library is maybe not the
best tools for this task, according to their website dpkt is best used for:

> fast, simple packet creation / parsing, with definitions for the basic
> TCP/IP protocols.

Use instead scapy which is a

> powerful interactive packet manipulation program for Python.

You can use a script like this

    
    
    from scapy.all import *
    packets = rdpcap('tmp.pcap')
    for p in packets:
        (p/Ether()).show()
    

Read [Infinite possibilities with Python's Scapy
Module](http://bt3gl.github.io/infinite-possibilities-with-pythons-scapy-
module.html) for more details.

