3rd-Party Engines#

Scapy Support#

This module contains the implementation for Scapy engine support, as is used by pcapkit.foundation.extraction.Extractor.

class pcapkit.foundation.engines.scapy.Scapy(extractor)[source]#

Bases: EngineBase[ScapyPacket]

Scapy engine support.

Parameters:

extractor (Extractor) – Extractor instance.

__engine_name__: str = 'Scapy'#

Engine name.

__engine_module__: str = 'scapy'#

Engine module name.

run()[source]#

Call scapy.sendrecv.sniff() to extract PCAP files.

This method assigns self._expkg as scapy.sendrecv and self._extmp as an iterator from scapy.sendrecv.sniff().

Warns:

AttributeWarning – If self.extractor._exlyr and/or self.extractor._exptl is provided as the Scapy engine currently does not support such operations.

Return type:

None

read_frame()[source]#

Read frames with Scapy engine.

Return type:

Packet

Returns:

Parsed frame instance.

See also

Please refer to PCAP.read_frame for more operational information.

_expkg: scapy.sendrecv#

Engine extraction package.

_extmp: Iterator[ScapyPacket]#

Engine extraction temporary storage.

DPKT Support#

This module contains the implementation for DPKT engine support, as is used by pcapkit.foundation.extraction.Extractor.

class pcapkit.foundation.engines.dpkt.DPKT(extractor)[source]#

Bases: EngineBase[DPKTPacket]

DPKT engine support.

Parameters:

extractor (Extractor) – Extractor instance.

__engine_name__: str = 'DPKT'#

Engine name.

__engine_module__: str = 'dpkt'#

Engine module name.

run()[source]#

Call dpkt.pcap.Reader to extract PCAP files.

This method assigns self._expkg as dpkt and self._extmp as an iterator from dpkt.pcap.Reader.

Warns:

AttributeWarning – If self.extractor._exlyr and/or self.extractor._exptl is provided as the DPKT engine currently does not support such operations.

Raises:

FormatError – If the file format is not supported, i.e., not a PCAP and/or PCAP-NG file.

Return type:

None

read_frame()[source]#

Read frames with DPKT engine.

Return type:

Packet

Returns:

Parsed frame instance.

See also

Please refer to PCAP.read_frame for more operational information.

_expkg: dpkt#

Engine extraction package.

_extmp: Reader#

Engine extraction temporary storage.

PyShark Support#

This module contains the implementation for PyShark engine support, as is used by pcapkit.foundation.extraction.Extractor.

class pcapkit.foundation.engines.pyshark.PyShark(extractor)[source]#

Bases: EngineBase[PySharkPacket]

PyShark engine support.

Parameters:

extractor (Extractor) – Extractor instance.

__engine_name__: str = 'PyShark'#

Engine name.

__engine_module__: str = 'pyshark'#

Engine module name.

run()[source]#

Call pyshark.FileCapture to extract PCAP files.

This method assigns self._expkg as pyshark and self._extmp as an iterator from pyshark.FileCapture.

Warns:

AttributeWarning – Warns under following circumstances:

  • if self.extractor._exlyr and/or self.extractor._exptl is provided as the PyShark engine currently does not support such operations.

  • if reassembly is enabled, as the PyShark engine currently does not support such operation.

Return type:

None

read_frame()[source]#

Read frames with PyShark engine.

Return type:

Packet

Returns:

Parsed frame instance.

See also

Please refer to PCAP.read_frame for more operational information.

close()[source]#

Close engine.

This method is to be used for closing the engine instance. It is to close the engine instance after the extraction process is finished.

Return type:

None

_expkg: pyshark#

Engine extraction package.

_extmp: FileCapture#

Engine extraction temporary storage.