Python wrapper for tshark, allowing python packet parsing using wireshark dissectors.
Extended documentation: http://kiminewt.github.io/pyshark
Python2 deprecation - This package no longer supports Python2. If you wish to still use it in Python2, you can:
Looking for contributors - for various reasons I have a hard time finding time to maintain and enhance the package at the moment. Any pull-requests will be reviewed and if any one is interested and is suitable, I will be happy to include them in the project. Feel free to mail me at dorgreen1 at gmail.
There are quite a few python packet parsing modules, this one is different because it doesn't actually parse any packets, it simply uses tshark's (wireshark command-line utility) ability to export XMLs to use its parsing.
This package allows parsing from a capture file or a live capture, using all wireshark dissectors you have installed. Tested on windows/linux.
Simply run the following to install the latest from pypi
pip install pyshark
Or install from the git repository:
git clone https://github.com/KimiNewt/pyshark.git cd pyshark/src python setup.py install
You may have to install libxml which can be unexpected. If you receive an error from clang or an error message about libxml, run the following:
xcode-select --install pip install libxml
You will probably have to accept a EULA for XCode so be ready to click an "Accept" dialog in the GUI.
>>> import pyshark >>> cap = pyshark.FileCapture('/tmp/mycapture.cap') >>> cap <FileCapture /tmp/mycapture.cap (589 packets)> >>> print cap Packet (Length: 698) Layer ETH: Destination: BLANKED Source: BLANKED Type: IP (0x0800) Layer IP: Version: 4 Header Length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) Total Length: 684 Identification: 0x254f (9551) Flags: 0x00 Fragment offset: 0 Time to live: 1 Protocol: UDP (17) Header checksum: 0xe148 [correct] Source: BLANKED Destination: BLANKED ...
>>> capture = pyshark.LiveCapture(interface='eth0') >>> capture.sniff(timeout=50) >>> capture <LiveCapture (5 packets)> >>> capture <UDP/HTTP Packet> for packet in capture.sniff_continuously(packet_count=5): print 'Just arrived:', packet
>>> capture = pyshark.LiveRingCapture(interface='eth0') >>> capture.sniff(timeout=50) >>> capture <LiveCapture (5 packets)> >>> capture <UDP/HTTP Packet> for packet in capture.sniff_continuously(packet_count=5): print 'Just arrived:', packet
>>> capture = pyshark.RemoteCapture('192.168.1.101', 'eth0') >>> capture.sniff(timeout=50) >>> capture
Data can be accessed in multiple ways. Packets are divided into layers, first you have to reach the appropriate layer and then you can select your field.
All of the following work:
>>> packet['ip'].dst 192.168.0.1 >>> packet.ip.src 192.168.0.100 >>> packet.src 192.168.0.100
To test whether a layer is in a packet, you can use its name:
>>> 'IP' in packet True
To see all possible field names, use the
packet.layer.field_names attribute (i.e.
packet.ip.field_names) or the autocomplete function on your interpreter.
You can also get the original binary data of a field, or a pretty description of it:
>>> p.ip.addr.showname Source or Destination Address: 10.0.0.10 (10.0.0.10) # And some new attributes as well: >>> p.ip.addr.int_value 167772170 >>> p.ip.addr.binary_value '\n\x00\x00\n'
Pyshark supports automatic decryption of traces using the WEP, WPA-PWD, and WPA-PSK standards (WPA-PWD is the default).
>>> cap1 = pyshark.FileCapture('/tmp/capture1.cap', decryption_key='password') >>> cap2 = pyshark.LiveCapture(interface='wi0', decryption_key='password', encryption_type='wpa-psk')
A tuple of supported encryption standards, SUPPORTED_ENCRYPTION_STANDARDS, exists in each capture class.
>>> pyshark.FileCapture.SUPPORTED_ENCRYPTION_STANDARDS ('wep', 'wpa-pwd', 'wpa-psk') >>> pyshark.LiveCapture.SUPPORTED_ENCRYPTION_STANDARDS ('wep', 'wpa-pwd', 'wpa-psk')
Pyshark display filters can be helpful in analyzing application focused traffic. BPF filters do not offer as much flexibility as Wireshark's display filters.
>>> cap1 = pyshark.FileCapture('/tmp/capture1.cap', display_filter="dns") >>> cap2 = pyshark.LiveCapture(interface='en0', display_filter="tcp.analysis.retransmission")
This project is licensed under MIT. Contributions to this project are accepted under the same license.