Core Interface

pcapkit.interface.core defines core user-oriented interfaces, variables, and etc., which wraps around the foundation classes from pcapkit.foundation.

pcapkit.interface.core.extract(fin=None, fout=None, format=None, auto=True, extension=True, store=True, files=False, nofile=False, verbose=False, engine=None, layer=None, protocol=None, reassembly=False, reasm_strict=True, reasm_store=True, trace=False, trace_fout=None, trace_format=None, trace_byteorder='little', trace_nanosecond=False, ip=False, ipv4=False, ipv6=False, tcp=False, buffer_size=8192, buffer_save=False, buffer_path=None, no_eof=False)[source]

Extract a PCAP file.

Parameters:

  • fin (Union[str, IO[bytes], None]) – file name to be read or a binary IO object; if file not exist, raise FileNotFound

  • fout (Optional[str]) – file name to be written

  • format (Optional[Literal['pcap', 'json', 'tree', 'plist']]) – file format of output

  • auto (bool) – if automatically run till EOF

  • extension (bool) – if check and append extensions to output file

  • store (bool) – if store extracted packet info

  • files (bool) – if split each frame into different files

  • nofile (bool) – if no output file is to be dumped

  • verbose (Union[bool, Callable[[Extractor, Union[Frame, PCAPNG, Packet, Packet, Packet]], Any]]) – a bool value or a function takes the Extractor instance and current parsed frame (depends on engine selected) as parameters to print verbose output information

  • engine (Optional[Literal['default', 'pcapkit', 'dpkt', 'scapy', 'pyshark']]) – extraction engine to be used

  • layer (Union[Literal['link', 'internet', 'transport', 'application', 'none'], None, Type[ProtocolBase]]) – extract til which layer

  • protocol (Union[str, ProtocolBase, Type[ProtocolBase], None]) – extract til which protocol

  • reassembly (bool) – if perform reassembly

  • reasm_strict (bool) – if set strict flag for reassembly

  • reasm_store (bool) – if store reassembled datagrams

  • trace (bool) – if trace TCP traffic flows

  • trace_fout (Optional[str]) – path name for flow tracer if necessary

  • trace_format (Optional[Literal['pcap', 'json', 'tree', 'plist']]) – output file format of flow tracer

  • trace_byteorder (Literal['big', 'little']) – output file byte order

  • trace_nanosecond (bool) – output nanosecond-resolution file flag

  • ip (bool) – if record data for IPv4 & IPv6 reassembly (must be used with reassembly=True)

  • ipv4 (bool) – if perform IPv4 reassembly (must be used with reassembly=True)

  • ipv6 (bool) – if perform IPv6 reassembly (must be used with reassembly=True)

  • tcp (bool) – if perform TCP reassembly and/or flow tracing (must be used with reassembly=True or trace=True)

  • buffer_size (int) – buffer size for reading input file (for SeekableReader only)

  • buffer_save (bool) – if save buffer to file (for SeekableReader only)

  • buffer_path (Optional[str]) – path name for buffer file if necessary (for SeekableReader only)

  • no_eof (bool) – if not raise EOFError when reach EOF

Return type:

Extractor

Returns:

An Extractor object.

pcapkit.interface.core.reassemble(protocol, strict=False)[source]

Reassemble fragmented datagrams.

Parameters:

  • protocol (Union[str, Type[ProtocolBase]]) – protocol to be reassembled

  • strict (bool) – if return all datagrams (including those not implemented) when submit

Return type:

ReassemblyBase

Returns:

A Reassembly object of corresponding protocol.

Raises:

FormatError – If protocol is NOT any of IPv4, IPv6 or TCP.

pcapkit.interface.core.trace(protocol, fout, format, byteorder='little', nanosecond=False)[source]

Trace flows.

Parameters:

  • protocol (Union[str, Type[ProtocolBase]]) – protocol to be reassembled

  • fout (Optional[str]) – output path

  • format (Optional[str]) – output format

  • byteorder (Literal['little', 'big']) – output file byte order

  • nanosecond (bool) – output nanosecond-resolution file flag

Return type:

TraceFlowBase

Returns:

A TraceFlow object.

Raises:

FormatError – If protocol is NOT TCP.

Constants Defintion

Output File Formats

pcapkit.interface.core.TREE = 'tree'
pcapkit.interface.core.JSON = 'json'
pcapkit.interface.core.PLIST = 'plist'
pcapkit.interface.core.PCAP = 'pcap'

Layer Thresholds

pcapkit.interface.core.RAW = 'none'
pcapkit.interface.core.INET = 'internet'
pcapkit.interface.core.TRANS = 'transport'
pcapkit.interface.core.APP = 'application'

Extration Engines

pcapkit.interface.core.DPKT = 'dpkt'
pcapkit.interface.core.Scapy = 'scapy'
pcapkit.interface.core.PCAPKit = 'default'
pcapkit.interface.core.PyShark = 'pyshark'