松哥的笔记

使用python进行数据包分析

2024-10-11 lqy python

import pyshark
import os
import xlwt

def getData(path):
    files=os.listdir(path)
    a = xlwt.Workbook()
    frame=a.add_sheet("frame")
    eth=a.add_sheet("eth")
    ip=a.add_sheet("ip")
    tcp=a.add_sheet("tcp")
    bgp=a.add_sheet("bgp")
    aaa=0
    for file in files:
        pkts = pyshark.FileCapture(path+file,
                                   tshark_path="C:\Program Files\Wireshark\tshark.exe")
        for pkt in pkts:
            # print(pkt)
            try:
#                print(pkt.bgp) #过滤对应的协议
#                print(type(pkt.frame_info)) #过滤对应的协
                frame.write(aaa,0,str(pkt.frame_info))
            except:
                print("包类型错误")
            try:
                eth.write(aaa,0,str(pkt.eth))
               # print(pkt.eth) #过滤对应的协议
            except:
                print("包类型错误")
            try:
                ip.write(aaa,0,str(pkt.ip))
               # print(pkt.tcp)  #过滤对应的协议
            except:
                print("包类型错误")
            try:
                tcp.write(aaa,0,str(pkt.tcp))
               # print(pkt.tcp)  #过滤对应的协议
            except:
                print("包类型错误")
            try:
                bgps = pkt.get_multiple_layers("bgp")
                for bg in bgps:
                    bgp.write(aaa, 0, str(bg))
#                    print(bgp.get_field_by_showname("Type"), end="\t")
 #               bgp.write(aaa,0,str(pkt.bgp))
               # print(pkt.tcp)  #过滤对应的协议
            except:
                print("包类型错误")
            aaa = aaa + 1
    a.save("ip包.xlsx")
#            print(pkt.ip.get_field_by_showname("Source Address"))

def getMultiple():
    file="./BGP/EBGP_adjacency.cap"
    pkts = pyshark.FileCapture(file,
                               tshark_path="C:\Program Files\Wireshark\tshark.exe")
    for pkt in pkts:
        bgps=pkt.get_multiple_layers("bgp")
        for bgp in bgps:
            print(bgp.get_field_by_showname("Type"),end="\t")
getData("./BGP/")
#getMultiple()
#获取frame,eth,ip,tcp,bgp(有多个)中的所有数据，里面有找不到的数据。
#将找到的数据写入到excel

标签: python