scapy 中sniff指定的数据包并打印指定信息

深藏阁楼爱情的钟 2021-11-16 06:48 649阅读 0赞

在理解这篇文章前可以先看看这两篇文章：

[https://www.cnblogs.com/liyuanhong/p/10925582.html][https_www.cnblogs.com_liyuanhong_p_10925582.html]

[https://www.cnblogs.com/liyuanhong/p/10925832.html][https_www.cnblogs.com_liyuanhong_p_10925832.html]

1、抓取报文，并打印出来

#将抓取到的报文的summary打印出来
    sniff(filter="icmp", prn=lambda x:x.summary(), count=10)

#抓取tcp报文，并打印目的地ip地址
    sniff(filter="tcp", prn=lambda x:x[TCP].dst, count=10)

抓取源地址为172.31.100.222的端口为80的tcp报文
    sniff(filter="ip src 172.31.100.222 and tcp and tcp port 80", prn=lambda x:x.summary())

或者定义一个回调函数：

def packet_callback(packet):
        print packet.show()
    
    sniff(prn=packet_callback, count=10)

#coding:utf-8
    from scapy.all import *
    #显示网卡信息
    #show_interfaces()
    
    def getRaw(p):
        print("aaa")
        #判断该类是否有Raw
        if hasattr(p,"Raw"):
            pass
        else:
            print(p[Raw])
            
    def getRaw1(p):
        raw = None
        p.sprintf("%IP.dst%")
        hexdump(p)
        try:
            print("=================================")
            raw = p[Raw]
            raw.show()
            #print(raw.load)
            #raw.sprintf("%Raw.load%")except:
            pass
            
    
    dpkg = sniff(filter="tcp",count=10,prn=getRaw1)
    
    '''
    for i in dpkg:
        print("------------------------------------------")
        #i.show()
        
        
    '''

转载于:https://www.cnblogs.com/liyuanhong/p/10927290.html

[https_www.cnblogs.com_liyuanhong_p_10925582.html]: https://www.cnblogs.com/liyuanhong/p/10925582.html
[https_www.cnblogs.com_liyuanhong_p_10925832.html]: https://www.cnblogs.com/liyuanhong/p/10925832.html