Package dpkt :: Module pcap
[hide private]
[frames] | no frames]

Source Code for Module dpkt.pcap

  1  # $Id: pcap.py 56 2009-11-06 22:28:26Z jon.oberheide $ 
  2   
  3  """Libpcap file format.""" 
  4   
  5  import sys, time 
  6  import dpkt 
  7   
  8  TCPDUMP_MAGIC = 0xa1b2c3d4L 
  9  PMUDPCT_MAGIC = 0xd4c3b2a1L 
 10   
 11  PCAP_VERSION_MAJOR = 2 
 12  PCAP_VERSION_MINOR = 4 
 13   
 14  DLT_NULL               = 0 
 15  DLT_EN10MB             = 1 
 16  DLT_EN3MB              = 2 
 17  DLT_AX25               = 3 
 18  DLT_PRONET             = 4 
 19  DLT_CHAOS              = 5 
 20  DLT_IEEE802            = 6 
 21  DLT_ARCNET             = 7 
 22  DLT_SLIP               = 8 
 23  DLT_PPP                = 9 
 24  DLT_FDDI               = 10 
 25  DLT_PFSYNC             = 18 
 26  DLT_IEEE802_11         = 105 
 27  DLT_LINUX_SLL          = 113 
 28  DLT_PFLOG              = 117 
 29  DLT_IEEE802_11_RADIO   = 127 
 30   
 31  if sys.platform.find('openbsd') != -1: 
 32      DLT_LOOP           = 12 
 33      DLT_RAW            = 14 
 34  else: 
 35      DLT_LOOP           = 108 
 36      DLT_RAW            = 12 
 37   
 38  dltoff = { DLT_NULL:4, DLT_EN10MB:14, DLT_IEEE802:22, DLT_ARCNET:6, 
 39             DLT_SLIP:16, DLT_PPP:4, DLT_FDDI:21, DLT_PFLOG:48, DLT_PFSYNC:4, 
 40             DLT_LOOP:4, DLT_LINUX_SLL:16 } 
 41   
42 -class PktHdr(dpkt.Packet):
43 """pcap packet header.""" 44 __hdr__ = ( 45 ('tv_sec', 'I', 0), 46 ('tv_usec', 'I', 0), 47 ('caplen', 'I', 0), 48 ('len', 'I', 0), 49 )
50
51 -class LEPktHdr(PktHdr):
52 __byte_order__ = '<'
53
54 -class FileHdr(dpkt.Packet):
55 """pcap file header.""" 56 __hdr__ = ( 57 ('magic', 'I', TCPDUMP_MAGIC), 58 ('v_major', 'H', PCAP_VERSION_MAJOR), 59 ('v_minor', 'H', PCAP_VERSION_MINOR), 60 ('thiszone', 'I', 0), 61 ('sigfigs', 'I', 0), 62 ('snaplen', 'I', 1500), 63 ('linktype', 'I', 1), 64 )
65
66 -class LEFileHdr(FileHdr):
67 __byte_order__ = '<'
68
69 -class Writer(object):
70 """Simple pcap dumpfile writer."""
71 - def __init__(self, fileobj, snaplen=1500, linktype=DLT_EN10MB):
72 self.__f = fileobj 73 fh = FileHdr(snaplen=snaplen, linktype=linktype) 74 self.__f.write(str(fh))
75
76 - def writepkt(self, pkt, ts=None):
77 if ts is None: 78 ts = time.time() 79 s = str(pkt) 80 n = len(s) 81 ph = PktHdr(tv_sec=int(ts), 82 tv_usec=int((float(ts) - int(ts)) * 1000000.0), 83 caplen=n, len=n) 84 self.__f.write(str(ph)) 85 self.__f.write(s)
86
87 - def close(self):
88 self.__f.close()
89
90 -class Reader(object):
91 """Simple pypcap-compatible pcap file reader.""" 92
93 - def __init__(self, fileobj):
94 self.name = fileobj.name 95 self.fd = fileobj.fileno() 96 self.__f = fileobj 97 buf = self.__f.read(FileHdr.__hdr_len__) 98 self.__fh = FileHdr(buf) 99 self.__ph = PktHdr 100 if self.__fh.magic == PMUDPCT_MAGIC: 101 self.__fh = LEFileHdr(buf) 102 self.__ph = LEPktHdr 103 elif self.__fh.magic != TCPDUMP_MAGIC: 104 raise ValueError, 'invalid tcpdump header' 105 if self.__fh.linktype in dltoff: 106 self.dloff = dltoff[self.__fh.linktype] 107 else: 108 self.dloff = 0 109 self.snaplen = self.__fh.snaplen 110 self.filter = ''
111
112 - def fileno(self):
113 return self.fd
114 117
118 - def setfilter(self, value, optimize=1):
119 return NotImplementedError
120
121 - def readpkts(self):
122 return list(self)
123
124 - def dispatch(self, cnt, callback, *args):
125 if cnt > 0: 126 for i in range(cnt): 127 ts, pkt = self.next() 128 callback(ts, pkt, *args) 129 else: 130 for ts, pkt in self: 131 callback(ts, pkt, *args)
132
133 - def loop(self, callback, *args):
134 self.dispatch(0, callback, *args)
135
136 - def __iter__(self):
137 self.__f.seek(FileHdr.__hdr_len__) 138 while 1: 139 buf = self.__f.read(PktHdr.__hdr_len__) 140 if not buf: break 141 hdr = self.__ph(buf) 142 buf = self.__f.read(hdr.caplen) 143 yield (hdr.tv_sec + (hdr.tv_usec / 1000000.0), buf)
144 145 if __name__ == '__main__': 146 import unittest 147
148 - class PcapTestCase(unittest.TestCase):
149 - def test_endian(self):
150 be = '\xa1\xb2\xc3\xd4\x00\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x60\x00\x00\x00\x01' 151 le = '\xd4\xc3\xb2\xa1\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x60\x00\x00\x00\x01\x00\x00\x00' 152 befh = FileHdr(be) 153 lefh = LEFileHdr(le) 154 self.failUnless(befh.linktype == lefh.linktype)
155 156 unittest.main() 157