title: Using Python to search through a PCAP file and return key information about the search query
body: <p>We have been given a PCAP file and my job is to find:</p>
  
  <p><em>Before the user got infected/attacked, they used a popular search engine (not Google) to search some information. Use Python to find out <strong>1) which search engine and 2) which keywords they used to do such searches. 3) Which website did the search engine recommend and 4) which website did the user actually access?</em></strong></p>
  
  <p>By opening the PCAP file on Wireshark, I have already found the correct answer to be: Bing </p>
  
  <p>although I still haven't been able to determine parts 2, 3, and 4</p>
  
  <p>However this is obviously not the purpose of the assignment as I have to use Python to return the information</p>
  
  <p>The code I have so far is:</p>
  
  <pre><code>pcapfile = open('nameofpcapfile.pcap', 'rb')
  
  x = pcapfile.read()
  decoded = x.decode("iso-8859-1")
  
  searchengines = ["www.google.com", "www.yahoo.com", "www.ask.com", "www.bing.com",
                   "www.aol.com", "www.baidu.com", "www.wolframalpha.com",
                   "www.duckduckgo.com", "www.yandex.ru"]
  
  searchenginesfound = []
  
  for i in searchengines:
      if i in decoded:
          searchenginesfound.append(i)
  
  
  if searchenginesfound.__len__() == 0:
      print("Search engine not found")
  elif searchenginesfound.__len__() == 1:
      print("Search Engine used: ", searchenginesfound)
  elif searchenginesfound.__len__() &gt; 1:
      print("Search Engines used: ", searchenginesfound)
  </code></pre>
  
  <p>This code is able to successfully return bing.com as the search engine used. However, I have no idea what to do for parts 2, 3, and 4</p>
  
  <p>Any suggestions?</p>