python dpkt解析流量包

!/usr/bin/python

coding=utf-8

import dpkt
import socket

def printPcap(pcap):
# 遍历[timestamp, packet]记录的数组
for (ts, buf) in pcap:
try:
# 获取以太网部分数据
eth = dpkt.ethernet.Ethernet(buf)
# 获取IP层数据
ip = eth.data
# 把存储在inet_ntoa中的IP地址转换成一个字符串
src = socket.inet_ntoa(ip.src)
dst = socket.inet_ntoa(ip.dst)
print '[+] Src: ' + src + ' --> Dst: ' + dst
except:
pass

def main():
f = open('geotest.pcap')
pcap = dpkt.pcap.Reader(f)
printPcap(pcap)

if name == 'main':
main()