1
2
3 """Libpcap file format."""
4
5 import sys, time
6 import dpkt
7
8 TCPDUMP_MAGIC = 0xa1b2c3d4L
9 PMUDPCT_MAGIC = 0xd4c3b2a1L
10
11 PCAP_VERSION_MAJOR = 2
12 PCAP_VERSION_MINOR = 4
13
14 DLT_NULL = 0
15 DLT_EN10MB = 1
16 DLT_EN3MB = 2
17 DLT_AX25 = 3
18 DLT_PRONET = 4
19 DLT_CHAOS = 5
20 DLT_IEEE802 = 6
21 DLT_ARCNET = 7
22 DLT_SLIP = 8
23 DLT_PPP = 9
24 DLT_FDDI = 10
25
26 DLT_LINUX_SLL = 113
27
28 DLT_PFLOG = 117
29 DLT_PFSYNC = 18
30 if sys.platform.find('openbsd') != -1:
31 DLT_LOOP = 12
32 DLT_RAW = 14
33 else:
34 DLT_LOOP = 108
35 DLT_RAW = 12
36
37 dltoff = { DLT_NULL:4, DLT_EN10MB:14, DLT_IEEE802:22, DLT_ARCNET:6,
38 DLT_SLIP:16, DLT_PPP:4, DLT_FDDI:21, DLT_PFLOG:48, DLT_PFSYNC:4,
39 DLT_LOOP:4, DLT_RAW:0, DLT_LINUX_SLL:16 }
40
42 """pcap packet header."""
43 __hdr__ = (
44 ('tv_sec', 'I', 0),
45 ('tv_usec', 'I', 0),
46 ('caplen', 'I', 0),
47 ('len', 'I', 0),
48 )
49
52
54 """pcap file header."""
55 __hdr__ = (
56 ('magic', 'I', TCPDUMP_MAGIC),
57 ('v_major', 'H', PCAP_VERSION_MAJOR),
58 ('v_minor', 'H', PCAP_VERSION_MINOR),
59 ('thiszone', 'I', 0),
60 ('sigfigs', 'I', 0),
61 ('snaplen', 'I', 1500),
62 ('linktype', 'I', 1),
63 )
64
67
69 """Simple pcap dumpfile writer."""
71 self.__f = fileobj
72 fh = FileHdr(snaplen=snaplen, linktype=linktype)
73 self.__f.write(str(fh))
74
76 if ts is None:
77 ts = time.time()
78 s = str(pkt)
79 n = len(s)
80 ph = PktHdr(tv_sec=int(ts),
81 tv_usec=int((int(ts) - float(ts)) * 1000000.0),
82 caplen=n, len=n)
83 self.__f.write(str(ph))
84 self.__f.write(s)
85
88
90 """Simple pypcap-compatible pcap file reader."""
91
93 self.name = fileobj.name
94 self.fd = fileobj.fileno()
95 self.__f = fileobj
96 buf = self.__f.read(FileHdr.__hdr_len__)
97 self.__fh = FileHdr(buf)
98 self.__ph = PktHdr
99 if self.__fh.magic == PMUDPCT_MAGIC:
100 self.__fh = LEFileHdr(buf)
101 self.__ph = LEPktHdr
102 elif self.__fh.magic != TCPDUMP_MAGIC:
103 raise ValueError, 'invalid tcpdump header'
104 self.snaplen = self.__fh.snaplen
105 self.dloff = dltoff[self.__fh.linktype]
106 self.filter = ''
107
110
112 return self.__fh.linktype
113
115 return NotImplementedError
116
119
120 - def dispatch(self, cnt, callback, *args):
121 if cnt > 0:
122 for i in range(cnt):
123 ts, pkt = self.next()
124 callback(ts, pkt, *args)
125 else:
126 for ts, pkt in self:
127 callback(ts, pkt, *args)
128
129 - def loop(self, callback, *args):
131
133 self.__f.seek(FileHdr.__hdr_len__)
134 while 1:
135 buf = self.__f.read(PktHdr.__hdr_len__)
136 if not buf: break
137 hdr = self.__ph(buf)
138 buf = self.__f.read(hdr.caplen)
139 yield (hdr.tv_sec + (hdr.tv_usec / 1000000.0), buf)
140