Re: Parse a Wireshark pcap file

2016-12-30 Thread Grant Edwards
On 2016-12-27, 1991manish.ku...@gmail.com <1991manish.ku...@gmail.com> wrote: > > I have a pcap file, I want to parse that file & fetch some > information like Timestamp, Packet Size, Source/Dest IP Address, > Source/Dest Port, Source/ Dest MAC address. I've been using pylibpcap for ages. It's a

Re: Parse a Wireshark pcap file

2016-12-28 Thread Michiel Overtoom
> On 2016-12-27, at 20:46, 1991manish.ku...@gmail.com wrote: > > I have a pcap file, I want to parse that file & fetch some information like > Timestamp, Packet Size, Source/Dest IP Address, Source/Dest Port, Source/ > Dest MAC address. pcapy can do this. import pcapy pcap = pcapy.open_offlin

Re: Parse a Wireshark pcap file

2016-12-27 Thread 1991manish . kumar
I have a pcap file, I want to parse that file & fetch some information like Timestamp, Packet Size, Source/Dest IP Address, Source/Dest Port, Source/ Dest MAC address. I am trying this in Django. other that Source/ Dest Port details, I am able to fetch everything. Please tell me how I can get

Re: Parse a Wireshark pcap file

2013-01-23 Thread Grant Edwards
On 2013-01-23, Kevin Holleran wrote: > Is there a way to parse out a wireshark pcap file and extract key value > pairs from the data? You can use pylibpcap to read pcap files (or to capture live data). I'm afraid I don't know what "parse out" or "extract key value pairs" means. pylibpcap doesn'

Re: Parse a Wireshark pcap file

2013-01-23 Thread John Evans
It looks like there was some very recent reorganization of the scapy packaging on macports, see http://lists.macosforge.org/pipermail/macports-dev/2013-January/021620.html Did you have an updated port tree when you installed? If not, I'd suggest uninstalling whatever port you installed, resync wi

Re: Parse a Wireshark pcap file

2013-01-23 Thread Kevin Holleran
On Wed, Jan 23, 2013 at 7:25 AM, John Evans wrote: > The import "from scapy.all import *" does work for me with macports and > 10.6.8 When I installed the scapy port, I did see that macports installed > the py27-libdnet package as well. > > >  > > > On Wed, Jan 23, 2013 at 1:24 AM, Dennis Lee Bi

Re: Parse a Wireshark pcap file

2013-01-23 Thread John Evans
The import "from scapy.all import *" does work for me with macports and 10.6.8 When I installed the scapy port, I did see that macports installed the py27-libdnet package as well. On Wed, Jan 23, 2013 at 1:24 AM, Dennis Lee Bieber wrote: > On Tue, 22 Jan 2013 22:43:24 -0500, Kevin Holleran

Re: Parse a Wireshark pcap file

2013-01-22 Thread Kevin Holleran
On Tue, Jan 22, 2013 at 10:29 PM, Dave Angel wrote: > On 01/22/2013 10:15 PM, Kevin Holleran wrote: > >> Thanks, I have been trying to get it to work but I am on Mac OS 10.8.2. I >> tried to get it from Macports and download/install it myself. Both seem >> to >> get me to here: >> >> ImportErro

Re: Parse a Wireshark pcap file

2013-01-22 Thread Dave Angel
On 01/22/2013 10:15 PM, Kevin Holleran wrote: Thanks, I have been trying to get it to work but I am on Mac OS 10.8.2. I tried to get it from Macports and download/install it myself. Both seem to get me to here: ImportError: No module named dnet I tried to download libdnet but no matter what I

Re: Parse a Wireshark pcap file

2013-01-22 Thread Kevin Holleran
I also found this: http://code.google.com/p/py-greppcap/ Which I can leverage to do what I want but I also get that dnet error! -- Kevin Holleran Master of Science, Computer Information Systems Grand Valley State University Master of Business Administration Western Michigan University SANS GCFA

Re: Parse a Wireshark pcap file

2013-01-22 Thread Kevin Holleran
Thanks, I have been trying to get it to work but I am on Mac OS 10.8.2. I tried to get it from Macports and download/install it myself. Both seem to get me to here: ImportError: No module named dnet I tried to download libdnet but no matter what I do this is what I get. Granted I am doing; fr

Re: Parse a Wireshark pcap file

2013-01-22 Thread Dave Angel
On 01/22/2013 08:32 PM, Kevin Holleran wrote: Is there a way to parse out a wireshark pcap file and extract key value pairs from the data? I am illustrated a sniff of some traffic and why it needs utilize HTTPS instead of HTTP but I was hoping to run the pcap through a python script and just out

Parse a Wireshark pcap file

2013-01-22 Thread Kevin Holleran
Is there a way to parse out a wireshark pcap file and extract key value pairs from the data? I am illustrated a sniff of some traffic and why it needs utilize HTTPS instead of HTTP but I was hoping to run the pcap through a python script and just output some interesting key value pairs Thanks