I need to get raw hex data from file.pcap just like in the programm 010Editor (screenshot 1) Especially i need to extract timestamp from packets.
Now i use this Python code:
##import pyshark
from scapy.all import rdpcap
print('----------------------------------------------')
filename = 'ipv6_10packets.pcap'
##pcap = pyshark.FileCapture(filename)
pcap = rdpcap(filename)
print('Parse pcap:', filename)
print('pcapType:', type(pcap))
print(pcap)
i = 0
for pkt in pcap:
i = i + 1
if i <= 15:
print(i, pkt)
## eth = dpkt.ethernet.Ethernet(pkt)
## print('eth= ', eth)
print(pcap[2])
a = pcap[2]
print(type(a))
b = str(a)
print(type(b))
print(b)
This code has output (screenshot 2) issues.
Problem 1 (marked pink): spontaneous character conversion. For example symbol "," should be decoded as \x2C
Symbol "@" should be decoded as \x40
Each "*" should be \x2A\
Problem 2: I can't get timestamp by this way.
Screenshot 1. Desired raw data in 010 Editor
Screenshot 2. Python output with character conversion issues
Attachment 'IPv6.pcap' file. https://easyupload.io/yhvdl6
How can i get raw data, especially i'm interested in timestamp. I will manipulate data of protocols. Libraries for this protocols haven't yet existed in wireshark. I need to parse data from file.pcap to get pure hex data and timestamp. Thanks in advance.
Problem 1 was solved by use:
Problem 2 was solved by use pyshark
My final code: