pcaper 1.0.0

Read pcap and assemble HTTP requests

Pcaper provides class to read pcap file, assemble and iterate HTTP requests. The package based on dpkt.

Installation

pip install pcaper

Import

import pcaper
reader = pcaper.HTTPRequest()

or

from pcaper import HTTPRequest
reader = HTTPRequest()

Examples

Iterate HTTP requests

Read pcap file, assemble and iterate HTTP requests

reader = pcaper.HTTPRequest()
params = {
    'input': 'file.pcap',
}
for request in reader.read_pcap(params):
    print request['origin']

Extract http headers

You can extract header by name

reader = pcaper.HTTPRequest()
params = {
    'input': 'file.pcap',
}
for request in reader.read_pcap(params):
    print request['headers']['host']
    print request['headers']['content-length']

Filter packets

It is possible to filter out excess packets

reader = pcaper.HTTPRequest()
params = {
    'input': 'file.pcap',
    'filter': 'tcp.dst == 1.1.1.1'
}
for request in reader.read_pcap(params):
    print request['origin']

You can combine tcp and ip filters in dpkt style

params1 = {
    'input': 'file.pcap',
    'filter': 'tcp.dport == 80 and ip.src == 1.1.1.1'
}

params2 = {
    'input': 'file.pcap',
    'filter': 'tcp.sport == 8888 or ip.dst == 2.2.2.2'
}

Notes

New pcapng format is not supported by dpkt package, but you can convert input file from pcapng to pcap format with standard utility, which is installed with wireshark package.

mergecap file.pcapng -w out.pcap -F pcap