pcap-parser

Python tool to parse pcap files and extract flow-related network traffic information. Extracts hostnames from DNS, TLS SNI, DHCP, and reverse DNS lookups, then aggregates packets into flows with statistics.

Features

• Parse .pcap and .pcapng files using tshark
• Hostname enrichment from DNS queries, TLS SNI, DHCP, and reverse DNS
• Device metadata extraction (OUI vendor, HTTP user-agent)
• Flow aggregation with packet counts, byte counts, and inter-arrival times
• Domain extraction from hostnames
• Persistent IP-to-hostname cache across runs

Requirements

• Python 3.9+
• tshark (comes with Wireshark)

Installation

pip install git+https://github.com/nyu-mlab/pcap-parser.git

Or for development:

git clone https://github.com/nyu-mlab/pcap-parser.git
cd pcap-parser
pip install -e ".[dev]"

Usage

Parse pcap files

Parse a single file:

pcap-parse output.csv /path/to/capture.pcap

Parse all pcap files in a directory:

pcap-parse output.csv /path/to/pcap_directory/

Aggregate into flows

After parsing, aggregate packets into flows:

pcap-flow output.csv aggregated_flows.csv

Output

pcap-parse produces a CSV with columns including:

pcap-flow aggregates these into flows with start/end timestamps, byte counts, packet counts, and average inter-arrival times.

Running tests

pytest tests/ -v

License

MIT — see LICENSE for details.