Print Packets Example¶

This example uses DPKT to read in a pcap file and print out the contents of the packets This example is focused on the fields in the Ethernet Frame and IP packet

Code Excerpt

# For each packet in the pcap process the contents
for timestamp, buf in pcap:

    # Print out the timestamp in UTC
    print 'Timestamp: ', str(datetime.datetime.utcfromtimestamp(timestamp))

    # Unpack the Ethernet frame (mac src/dst, ethertype)
    eth = dpkt.ethernet.Ethernet(buf)
    print 'Ethernet Frame: ', mac_addr(eth.src), mac_addr(eth.dst), eth.type

    # Make sure the Ethernet frame contains an IP packet
    if not isinstance(eth.data, dpkt.ip.IP):
        print 'Non IP Packet type not supported %s\n' % eth.data.__class__.__name__
        continue

    # Now unpack the data within the Ethernet frame (the IP packet)
    # Pulling out src, dst, length, fragment info, TTL, and Protocol
    ip = eth.data

    # Pull out fragment information (flags and offset all packed into off field, so use bitmasks)
    do_not_fragment = bool(ip.off & dpkt.ip.IP_DF)
    more_fragments = bool(ip.off & dpkt.ip.IP_MF)
    fragment_offset = ip.off & dpkt.ip.IP_OFFMASK

    # Print out the info
    print 'IP: %s -> %s   (len=%d ttl=%d DF=%d MF=%d offset=%d)\n' % \
          (inet_to_str(ip.src), inet_to_str(ip.dst), ip.len, ip.ttl, do_not_fragment, more_fragments, fragment_offset)

Example Output

Timestamp:  2004-05-13 10:17:07.311224
Ethernet Frame:  00:00:01:00:00:00 fe:ff:20:00:01:00 2048
IP: 145.254.160.237 -> 65.208.228.223   (len=48 ttl=128 DF=1 MF=0 offset=0)

Timestamp:  2004-05-13 10:17:08.222534
Ethernet Frame:  fe:ff:20:00:01:00 00:00:01:00:00:00 2048
IP: 65.208.228.223 -> 145.254.160.237   (len=48 ttl=47 DF=1 MF=0 offset=0)

...

dpkt/examples/print_packets.py

Use DPKT to read in a pcap file and print out the contents of the packets This example is focused on the fields in the Ethernet Frame and IP packet

examples.print_packets.mac_addr(address)[source]¶

Convert a MAC address to a readable/printable string

Parameters:	address (str) – a MAC address in hex form (e.g. ‘’)
Returns:	Printable/readable MAC address
Return type:	str

examples.print_packets.inet_to_str(inet)[source]¶

Convert inet object to a string

Parameters:	inet (inet struct) – inet network address
Returns:	Printable/readable IP address
Return type:	str

examples.print_packets.print_packets(pcap)[source]¶

Print out information about each packet in a pcap

Parameters:	pcap – dpkt pcap reader object (dpkt.pcap.Reader)

examples.print_packets.test()[source]¶: Open up a test pcap file and print out the packets