How to …

Basic Samples

pcapkit is quite easy to use, with simply three verbs as its main interface. Several scenarios are shown as below.

1. extract a PCAP file and dump the result to a specific file (with no reassembly)

   from pcapkit import extract
   # dump to a PLIST file with no frame storage (property frame disabled)
   plist = extract(fin='in.pcap', fout='out.plist', format='plist', store=False)
   # dump to a JSON file with no extension auto-complete
   json = extract(fin='in.cap', fout='out.json', format='json', extension=False)
   # dump to a folder with each tree-view text file per frame
   tree = extract(fin='in.pcap', fout='out', format='tree', files=True)
   

2. extract a PCAP file and fetch IP packet (both IPv4 and IPv6) from a frame (with no output file)

   from pcapkit import IP, extract
   extraction = extract(fin='in.pcap', nofile=True)
   frame0 = extraction.frame[0]
   # check if IP (IPv4 or IPv6) in this frame
   flag = IP in frame0
   if IP in frame0:
      # fetch the IP packet from this frame
      ip = frame0[IP]
   

3. extract a PCAP file and reassemble TCP payload (with no output file nor frame storage)

   from pcapkit import HTTP, extract
   # set strict to make sure full reassembly
   extraction = extract(fin='in.pcap', store=False, nofile=True, reassembly=True, tcp=True, strict=True)
   # print extracted packet if HTTP in reassembled payloads
   for datagram in extraction.reassembly.tcp:
       if datagram.packet is not None and HTTP in datagram.packet:
           print(datagram.packet[HTTP])
   

CLI Samples

The CLI (command line interface) of pcapkit has two different access.

• through console scripts

  Use command name pcapkit-cli [...] directly (as shown in samples).

• through Python module

  python -m pypcapkit [...] works exactly the same as above.

Here are some usage samples:

1. export to a macOS Property List (Xcode has special support for this format)

   $ pcapkit-cli in --format plist --verbose
   🚨Loading file 'in.pcap'
   Frame   1: Ethernet:IPv6:IPv6_ICMP
   Frame   2: Ethernet:IPv6:IPv6_ICMP
   Frame   3: Ethernet:IPv4:TCP
   Frame   4: Ethernet:IPv4:TCP
   Frame   5: Ethernet:IPv4:TCP
   Frame   6: Ethernet:IPv4:UDP:Raw
   🍺Report file stored in 'out.plist'
   

2. export to a JSON file (with no format specified)

   $ pcapkit-cli in --output out.json --verbose
   🚨Loading file 'in.pcap'
   Frame   1: Ethernet:IPv6:IPv6_ICMP
   Frame   2: Ethernet:IPv6:IPv6_ICMP
   Frame   3: Ethernet:IPv4:TCP
   Frame   4: Ethernet:IPv4:TCP
   Frame   5: Ethernet:IPv4:TCP
   Frame   6: Ethernet:IPv4:UDP:Raw
   🍺Report file stored in 'out.json'
   

3. export to a text tree view file (without extension autocorrect)

   $ pcapkit-cli in --output out.txt --format tree --verbose
   🚨Loading file 'in.pcap'
   Frame   1: Ethernet:IPv6:IPv6_ICMP
   Frame   2: Ethernet:IPv6:IPv6_ICMP
   Frame   3: Ethernet:IPv4:TCP
   Frame   4: Ethernet:IPv4:TCP
   Frame   5: Ethernet:IPv4:TCP
   Frame   6: Ethernet:IPv4:UDP:Raw
   🍺Report file stored in 'out.txt'