#Python3 scapy import how to

Next we will loop through the data and add them to the table from highest to lowest. The first step is to create the table with table(). Now we can use PrettyTable to sort and print the data. Now that you have a list of IPs from the packets we will use a counter to create a count. To do that we will loop through the packets using a try/except as not every packet will have the information we want (malformed, retransmit, etc). To print a source IP use pkt.srcįor our example we will need to read a PCAP file and store the source IP in a list. Each packet has attributes like source IP, destination IP, source port, destination port, bytes, etc. Packets in ScaPy have elements, we will only be dealing with packet’s IP data. ScaPy is a great tool for manipulating and reading packets and PrettyTables is just what you would imagine it is, a library to print pretty tables.įirst we will tell ScaPy to read all of the packets in the PCAP to a list, to do that use the rdpcap function. For this example we will use 2 external modules and 1 built in module.

#Python3 scapy import how to

We’ll read a packet capture and graph the number of times each source IP is seen in the packet.īefore we start visualizing the data we will learn how to read PCAP data with Python using ScaPy. This is a three-part post on visualizing network data with Python. Tools like Wireshark are great, but sometimes you need to automate or want to run something all on the terminal.

If you are in IT or Security you have had to look at packets to troubleshoot or investigate an issue.