Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save vijayanandrp/7927dcc64c33f42a6432b321806dfafd to your computer and use it in GitHub Desktop.
Save vijayanandrp/7927dcc64c33f42a6432b321806dfafd to your computer and use it in GitHub Desktop.
Simple way to parse captured pcap file using python
#!/usr/bin/env python
import dpkt
import sys
import socket
import urlparse
captured_pcap = file("captured.pcap", 'rb')
fpcap = dpkt.pcap.Reader(captured_pcap)
url_request = []
for ts,buf in fpcap:
eth = dpkt.ethernet.Ethernet(buf)
ip = eth.data
tcp = ip.data
try:
ip_src = socket.inet_ntoa(ip.src) # converting into human readable format
ip_dst = socket.inet_ntoa(ip.dst)
except:
continue
ip_dst = ip_dst.strip()
if (tcp.dport == 80 or tcp.dport == 443) and len(tcp.data) > 0 : #and (ip_dst == '74.125.236.181' or ip_dst == '74.125.236.182'):
try:
http = dpkt.http.Request(tcp.data)
uri = http.uri
print uri
parsed = urlparse.urlparse(uri)
dict_url = urlparse.parse_qs(parsed.query)
#print set(dict_url)
url_request.append(dict_url)
except:
continue
print '*'*127
print '\n Splitting URI in to dictionary \n'
print '*'*127
for uri in url_request:
if len(uri) > 1:
print uri
captured_pcap.close()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment