How can I get raw hex data from .pcap

627 Views Asked by At

I need to get raw hex data from file.pcap just like in the programm 010Editor (screenshot 1) Especially i need to extract timestamp from packets.

Now i use this Python code:

##import pyshark
from scapy.all import rdpcap
print('----------------------------------------------')
filename = 'ipv6_10packets.pcap'
##pcap = pyshark.FileCapture(filename)
pcap = rdpcap(filename)
print('Parse pcap:', filename)
print('pcapType:', type(pcap))
print(pcap)
i = 0
for pkt in pcap:
    i = i + 1
    if i <= 15:
        print(i, pkt)
    ## eth = dpkt.ethernet.Ethernet(pkt)
## print('eth= ', eth)
print(pcap[2])
a = pcap[2]
print(type(a))
b = str(a)
print(type(b))
print(b)

This code has output (screenshot 2) issues.

Problem 1 (marked pink): spontaneous character conversion. For example symbol "," should be decoded as \x2C
Symbol "@" should be decoded as \x40
Each "*" should be \x2A\

Problem 2: I can't get timestamp by this way.

Screenshot 1. Desired raw data in 010 Editor
Screenshot 2. Python output with character conversion issues

Attachment 'IPv6.pcap' file. https://easyupload.io/yhvdl6

How can i get raw data, especially i'm interested in timestamp. I will manipulate data of protocols. Libraries for this protocols haven't yet existed in wireshark. I need to parse data from file.pcap to get pure hex data and timestamp. Thanks in advance.

1

There are 1 best solutions below

0
yks On

Problem 1 was solved by use:

import binascii
binascii.hexlify(bytes(pkt))

Problem 2 was solved by use pyshark

My final code:

import pyshark
from scapy.all import rdpcap
import binascii
print('----------------------------------------------')
filename = 'ipv6_10packets.pcap'
pcap = rdpcap(filename)
print('Parse pcap:', filename)
print('pcapType:', type(pcap))
print(pcap)
pcap_hex = []
i = 0
for pkt in pcap:
    if i <= 15:
        print(i, pkt)
        ##pkt = bytes(pkt)
        ##print(i, binascii.hexlify(pkt))
        pcap_hex.append(binascii.hexlify(bytes(pkt)))
        i = i + 1
print('pcap_hex:', pcap_hex)
print('length pcap_hex (count of pkts):', len(pcap_hex))
print('*******************')
pcap = pyshark.FileCapture(filename)
j = 0
time_pkt = []
for pkt in pcap:
    if j <= 15:
        j += 1
        ##print(i, pkt.frame_info)
        print('Time of pkt #', j, pkt.sniff_time)
        time_pkt.append(pkt.sniff_time)
        ##pkt.show()
print(time_pkt)
print('FINAL')