如何使用Python3和Scapy抓取并保存网络接口的数据包为pcap文件？

本文共计168个文字，预计阅读时间需要1分钟。

使用Python和Scapy实现包的抓取，脚本如下：

pythonfrom scapy.all import sniff, IP

def packet_callback(packet): if IP in packet: print(fIP: {packet[IP].src} -> {packet[IP].dst})

sniff(filter=ip, prn=packet_callback, store=False)

用python scapy实现包的抓取，脚本如下

#coding=utf-8
from scapy.all import *
count = input("Input catch tcp num:")
now_time = datetime.now().strftime( "%Y%m%d%H%M%S" )
filename = "./pcap/email_dns_data_{0}.pcap".format(now_time)
#filter = 'tcp.port == 2222'
o_open_file= PcapWriter(filename, append=True)
def callback(packet):
packet.show()
o_open_file.write(packet)

dpkt_input = sniff(iface = "Realtek PCIe GBE Family Controller",count = int(count), filter='tcp',prn = callback)

　　sniff解释:

iface 网卡filter 过滤条件，和wireshark 相同
count 抓包数量，0为永久抓包
prn 回调函数