3rd-Party Engines

Scapy Support

This module contains the implementation for Scapy engine support, as is used by pcapkit.foundation.extraction.Extractor.

class pcapkit.foundation.engines.scapy.Scapy(extractor)[source]

Bases: EngineBase[ScapyPacket]

Scapy engine support.

Parameters:

extractor (Extractor) – Extractor instance.

__engine_name__: str = 'Scapy'

Engine name.

__engine_module__: str = 'scapy'

Engine module name.

run()[source]

Call scapy.sendrecv.sniff() to extract PCAP files.

This method assigns self._expkg as scapy.sendrecv and self._extmp as an iterator from scapy.sendrecv.sniff().

Warns:

AttributeWarning – If self.extractor._exlyr and/or self.extractor._exptl is provided as the Scapy engine currently does not support such operations.

Return type:

None

read_frame()[source]

Read frames with Scapy engine.

Return type:

Packet

Returns:

Parsed frame instance.

See also

Please refer to PCAP.read_frame for more operational information.

_expkg: scapy.sendrecv

Engine extraction package.

_extmp: Iterator[ScapyPacket]

Engine extraction temporary storage.

DPKT Support

This module contains the implementation for DPKT engine support, as is used by pcapkit.foundation.extraction.Extractor.

class pcapkit.foundation.engines.dpkt.DPKT(extractor)[source]

Bases: EngineBase[DPKTPacket]

DPKT engine support.

Parameters:

extractor (Extractor) – Extractor instance.

__engine_name__: str = 'DPKT'

Engine name.

__engine_module__: str = 'dpkt'

Engine module name.

run()[source]

Call dpkt.pcap.Reader to extract PCAP files.

This method assigns self._expkg as dpkt and self._extmp as an iterator from dpkt.pcap.Reader.

Warns:

AttributeWarning – If self.extractor._exlyr and/or self.extractor._exptl is provided as the DPKT engine currently does not support such operations.

Raises:

FormatError – If the file format is not supported, i.e., not a PCAP and/or PCAP-NG file.

Return type:

None

read_frame()[source]

Read frames with DPKT engine.

Return type:

Packet

Returns:

Parsed frame instance.

See also

Please refer to PCAP.read_frame for more operational information.

_expkg: dpkt

Engine extraction package.

_extmp: Reader

Engine extraction temporary storage.

PyShark Support

This module contains the implementation for PyShark engine support, as is used by pcapkit.foundation.extraction.Extractor.

class pcapkit.foundation.engines.pyshark.PyShark(extractor)[source]

Bases: EngineBase[PySharkPacket]

PyShark engine support.

Parameters:

extractor (Extractor) – Extractor instance.

__engine_name__: str = 'PyShark'

Engine name.

__engine_module__: str = 'pyshark'

Engine module name.

run()[source]

Call pyshark.FileCapture to extract PCAP files.

This method assigns self._expkg as pyshark and self._extmp as an iterator from pyshark.FileCapture.

Warns:

AttributeWarning – Warns under following circumstances:

  • if self.extractor._exlyr and/or self.extractor._exptl is provided as the PyShark engine currently does not support such operations.

  • if reassembly is enabled, as the PyShark engine currently does not support such operation.

Return type:

None

read_frame()[source]

Read frames with PyShark engine.

Return type:

Packet

Returns:

Parsed frame instance.

See also

Please refer to PCAP.read_frame for more operational information.

close()[source]

Close engine.

This method is to be used for closing the engine instance. It is to close the engine instance after the extraction process is finished.

Return type:

None

_expkg: pyshark

Engine extraction package.

_extmp: FileCapture

Engine extraction temporary storage.