scapy 解析pcap数据包笔记

from scapy.all import *

def analyzePcap(filepath):

    s1 = PcapReader(filepath)

    # data 是以太网 数据包
    data = s1.read_packet()
    ip_packet = data.payload
    icmp_packet = ip_packet.payload
    payload = icmp_packet.payload 
    original_payload = payload.original
    hex_payload = original_payload.hex()

    print(type(payload))     # 
    print(type(original_payload)) # 
    print(type(hex_payload))    # 

    #print(type(data.payload))  #==>  可以使用 help(scapy.layers.inet.IP) 查看帮助文档

analyzePcap('weird_pcap/linux_icmp_with_timestamp.pcap')

payload.original是字节串， payload.original.hex() 是 十六进制形式的字符串。