Package dpkt :: Module pcap
[hide private]
[frames] | no frames]

Source Code for Module dpkt.pcap

  1  # $Id: pcap.py 371 2006-06-06 12:18:12Z dugsong $ 
  2   
  3  """Libpcap file format.""" 
  4   
  5  import sys, time 
  6  import dpkt 
  7   
  8  TCPDUMP_MAGIC = 0xa1b2c3d4L 
  9  PMUDPCT_MAGIC = 0xd4c3b2a1L 
 10   
 11  PCAP_VERSION_MAJOR = 2 
 12  PCAP_VERSION_MINOR = 4 
 13   
 14  DLT_NULL =      0 
 15  DLT_EN10MB =    1 
 16  DLT_EN3MB =     2 
 17  DLT_AX25 =      3 
 18  DLT_PRONET =    4 
 19  DLT_CHAOS =     5 
 20  DLT_IEEE802 =   6 
 21  DLT_ARCNET =    7 
 22  DLT_SLIP =      8 
 23  DLT_PPP =       9 
 24  DLT_FDDI =      10 
 25  # XXX - Linux 
 26  DLT_LINUX_SLL = 113 
 27  # XXX - OpenBSD 
 28  DLT_PFLOG =     117 
 29  DLT_PFSYNC =    18 
 30  if sys.platform.find('openbsd') != -1: 
 31      DLT_LOOP =          12 
 32      DLT_RAW =           14 
 33  else: 
 34      DLT_LOOP =          108 
 35      DLT_RAW =           12 
 36   
 37  dltoff = { DLT_NULL:4, DLT_EN10MB:14, DLT_IEEE802:22, DLT_ARCNET:6, 
 38             DLT_SLIP:16, DLT_PPP:4, DLT_FDDI:21, DLT_PFLOG:48, DLT_PFSYNC:4, 
 39             DLT_LOOP:4, DLT_RAW:0, DLT_LINUX_SLL:16 } 
 40   
41 -class PktHdr(dpkt.Packet):
42 """pcap packet header.""" 43 __hdr__ = ( 44 ('tv_sec', 'I', 0), 45 ('tv_usec', 'I', 0), 46 ('caplen', 'I', 0), 47 ('len', 'I', 0), 48 )
49
50 -class LEPktHdr(PktHdr):
51 __byte_order__ = '<'
52
53 -class FileHdr(dpkt.Packet):
54 """pcap file header.""" 55 __hdr__ = ( 56 ('magic', 'I', TCPDUMP_MAGIC), 57 ('v_major', 'H', PCAP_VERSION_MAJOR), 58 ('v_minor', 'H', PCAP_VERSION_MINOR), 59 ('thiszone', 'I', 0), 60 ('sigfigs', 'I', 0), 61 ('snaplen', 'I', 1500), 62 ('linktype', 'I', 1), 63 )
64
65 -class LEFileHdr(FileHdr):
66 __byte_order__ = '<'
67
68 -class Writer(object):
69 """Simple pcap dumpfile writer."""
70 - def __init__(self, fileobj, snaplen=1500, linktype=DLT_EN10MB):
71 self.__f = fileobj 72 fh = FileHdr(snaplen=snaplen, linktype=linktype) 73 self.__f.write(str(fh))
74
75 - def writepkt(self, pkt, ts=None):
76 if ts is None: 77 ts = time.time() 78 s = str(pkt) 79 n = len(s) 80 ph = PktHdr(tv_sec=int(ts), 81 tv_usec=int((int(ts) - float(ts)) * 1000000.0), 82 caplen=n, len=n) 83 self.__f.write(str(ph)) 84 self.__f.write(s)
85
86 - def close(self):
87 self.__f.close()
88
89 -class Reader(object):
90 """Simple pypcap-compatible pcap file reader.""" 91
92 - def __init__(self, fileobj):
93 self.name = fileobj.name 94 self.fd = fileobj.fileno() 95 self.__f = fileobj 96 buf = self.__f.read(FileHdr.__hdr_len__) 97 self.__fh = FileHdr(buf) 98 self.__ph = PktHdr 99 if self.__fh.magic == PMUDPCT_MAGIC: 100 self.__fh = LEFileHdr(buf) 101 self.__ph = LEPktHdr 102 elif self.__fh.magic != TCPDUMP_MAGIC: 103 raise ValueError, 'invalid tcpdump header' 104 self.snaplen = self.__fh.snaplen 105 self.dloff = dltoff[self.__fh.linktype] 106 self.filter = ''
107
108 - def fileno(self):
109 return self.fd
110 113
114 - def setfilter(self, value, optimize=1):
115 return NotImplementedError
116
117 - def readpkts(self):
118 return list(self)
119
120 - def dispatch(self, cnt, callback, *args):
121 if cnt > 0: 122 for i in range(cnt): 123 ts, pkt = self.next() 124 callback(ts, pkt, *args) 125 else: 126 for ts, pkt in self: 127 callback(ts, pkt, *args)
128
129 - def loop(self, callback, *args):
130 self.dispatch(0, callback, *args)
131
132 - def __iter__(self):
133 self.__f.seek(FileHdr.__hdr_len__) 134 while 1: 135 buf = self.__f.read(PktHdr.__hdr_len__) 136 if not buf: break 137 hdr = self.__ph(buf) 138 buf = self.__f.read(hdr.caplen) 139 yield (hdr.tv_sec + (hdr.tv_usec / 1000000.0), buf)
140