Pyshark tutorial

PyShark Tutorial

PyShark is a Python wrapper for tshark, a command-line network protocol analyzer. It allows you to analyze network captures programmatically using Python, providing a convenient way to automate network analysis tasks.

Here’s an example of how to use PyShark:

import pyshark

# Open a network capture file
capture = pyshark.FileCapture('capture.pcap')

# Iterate over packets
for packet in capture:
    print(packet)

In this example, we first import the pyshark module. We then create a FileCapture object by passing the path to a network capture file (‘capture.pcap’ in this case) to the constructor. We can iterate over the packets in the capture using a simple for loop.

PyShark provides a wide range of features to extract information from network captures. You can access various attributes of a packet, such as source and destination IP addresses, ports, protocols, etc. For example:

import pyshark

capture = pyshark.FileCapture('capture.pcap')

for packet in capture:
    # Access source and destination IP addresses
    src_ip = packet.ip.src
    dst_ip = packet.ip.dst
    
    # Access source and destination ports
    src_port = packet.tcp.srcport
    dst_port = packet.tcp.dstport
    
    # Access protocol
    protocol = packet.transport_layer
    
    # Print packet information
    print(f"Source IP: {src_ip}, Destination IP: {dst_ip}, Source Port: {src_port}, Destination Port: {dst_port}, Protocol: {protocol}")

In this example, we access various attributes of the packet object, such as packet.ip.src to get the source IP address, packet.ip.dst to get the destination IP address, packet.tcp.srcport to get the source port, packet.tcp.dstport to get the destination port, and packet.transport_layer to get the protocol.

PyShark also allows you to apply filters to capture only specific packets based on criteria such as IP addresses, ports, protocols, etc. For example:

import pyshark

capture = pyshark.LiveCapture(interface='eth0', display_filter='http')

for packet in capture.sniff_continuously(packet_count=10):
    print(packet)

In this example, we create a LiveCapture object by specifying the network interface to capture from (‘eth0’ in this case) and a display filter (‘http’ in this case) to capture only HTTP packets. We then use the sniff_continuously method to capture 10 packets and print them.

These are just a few examples of what you can do with PyShark. It provides many more features and options for network analysis. You can refer to the official PyShark documentation for more details and examples.