Simple PCAP file parser

Based on this and this PCAP Capture File Format description.

About

Simple PCAP was created to allow the user to focus as much as possible on processing packets stored in a pcap file without studying its structure. This is a very simple tool, it does not provide additional tools for analyzing packages. The library tries to provide the safest possible manipulation of pcap files.

Installation

From PyPI

pip install simplepcap

From GitHub

pip install git+https://github.com/ic-it/simplepcap.git

Usage example

Simple usage

from pprint import pprint
from simplepcap.parsers import DefaultParser


with DefaultParser(file_path="./pcaps/eth-1.pcap") as parser:
    pprint(parser.file_header)
    for packet in parser:
        pprint(packet)

Get all packets

from pprint import pprint
from simplepcap.parsers import DefaultParser


with DefaultParser(file_path="./pcaps/eth-1.pcap") as parser:
    packets = list(parser) # or packets = parser.get_all_packets()

pprint(packets)

Look at the examples folder for more examples.

Documentation

Look at the docs.

Contributing

Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.