1
2
3 """Libpcap file format."""
4
5 import sys, time
6 import dpkt
7
8 TCPDUMP_MAGIC = 0xa1b2c3d4L
9 PMUDPCT_MAGIC = 0xd4c3b2a1L
10
11 PCAP_VERSION_MAJOR = 2
12 PCAP_VERSION_MINOR = 4
13
14 DLT_NULL = 0
15 DLT_EN10MB = 1
16 DLT_EN3MB = 2
17 DLT_AX25 = 3
18 DLT_PRONET = 4
19 DLT_CHAOS = 5
20 DLT_IEEE802 = 6
21 DLT_ARCNET = 7
22 DLT_SLIP = 8
23 DLT_PPP = 9
24 DLT_FDDI = 10
25 DLT_PFSYNC = 18
26 DLT_IEEE802_11 = 105
27 DLT_LINUX_SLL = 113
28 DLT_PFLOG = 117
29 DLT_IEEE802_11_RADIO = 127
30
31 if sys.platform.find('openbsd') != -1:
32 DLT_LOOP = 12
33 DLT_RAW = 14
34 else:
35 DLT_LOOP = 108
36 DLT_RAW = 12
37
38 dltoff = { DLT_NULL:4, DLT_EN10MB:14, DLT_IEEE802:22, DLT_ARCNET:6,
39 DLT_SLIP:16, DLT_PPP:4, DLT_FDDI:21, DLT_PFLOG:48, DLT_PFSYNC:4,
40 DLT_LOOP:4, DLT_LINUX_SLL:16 }
41
43 """pcap packet header."""
44 __hdr__ = (
45 ('tv_sec', 'I', 0),
46 ('tv_usec', 'I', 0),
47 ('caplen', 'I', 0),
48 ('len', 'I', 0),
49 )
50
53
55 """pcap file header."""
56 __hdr__ = (
57 ('magic', 'I', TCPDUMP_MAGIC),
58 ('v_major', 'H', PCAP_VERSION_MAJOR),
59 ('v_minor', 'H', PCAP_VERSION_MINOR),
60 ('thiszone', 'I', 0),
61 ('sigfigs', 'I', 0),
62 ('snaplen', 'I', 1500),
63 ('linktype', 'I', 1),
64 )
65
68
70 """Simple pcap dumpfile writer."""
75
77 if ts is None:
78 ts = time.time()
79 s = str(pkt)
80 n = len(s)
81 ph = PktHdr(tv_sec=int(ts),
82 tv_usec=int((float(ts) - int(ts)) * 1000000.0),
83 caplen=n, len=n)
84 self.__f.write(str(ph))
85 self.__f.write(s)
86
89
91 """Simple pypcap-compatible pcap file reader."""
92
111
114
117
119 return NotImplementedError
120
123
124 - def dispatch(self, cnt, callback, *args):
125 if cnt > 0:
126 for i in range(cnt):
127 ts, pkt = self.next()
128 callback(ts, pkt, *args)
129 else:
130 for ts, pkt in self:
131 callback(ts, pkt, *args)
132
133 - def loop(self, callback, *args):
135
144
145 if __name__ == '__main__':
146 import unittest
147
150 be = '\xa1\xb2\xc3\xd4\x00\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x60\x00\x00\x00\x01'
151 le = '\xd4\xc3\xb2\xa1\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x60\x00\x00\x00\x01\x00\x00\x00'
152 befh = FileHdr(be)
153 lefh = LEFileHdr(le)
154 self.failUnless(befh.linktype == lefh.linktype)
155
156 unittest.main()
157