Auxiliary Interface

pcapkit.interface.misc contains auxiliary user interfaces, mostly added on users’ requests.

pcapkit.interface.misc.follow_tcp_stream(fin=None, verbose=False, extension=True, engine=None, fout=None, format=None, byteorder=sys.byteorder, nanosecond=False, trace_bidirectional=True, trace_analyse=False)[source]

Follow TCP streams.

Parameters:

  • fin (str | None) – file name to be read; if the file does not exist, raise FileNotFound

  • extension (bool) – if check and append extensions to output file

  • verbose (bool) – if print verbose output information

  • engine (Literal['default', 'pcapkit', 'dpkt', 'scapy', 'pyshark', 'pypcap', 'pcap_ct', 'pypcapfile'] | None) – extraction engine to be used

  • fout (str | None) – path name for flow tracer if necessary

  • format (Literal['pcap', 'cap', 'json', 'tree', 'text', 'txt', 'plist', 'xml'] | None) – output file format of flow tracer

  • byteorder (Literal['little', 'big']) – output file byte order

  • nanosecond (bool) – output nanosecond-resolution file flag

  • trace_bidirectional (bool) – whether both directions of a conversation are followed as one stream, which is the default; False gives one stream per direction

  • trace_analyse (bool) – whether each traced flow reassembles its application layer, so that Index.packet can be read off Extractor.trace. Off by default; the returned conversations come from the TCP reassembly this function always runs.

Return type:

tuple[Stream, ...]

Returns:

Tuple of extracted TCP streams.

Changed in version 1.5.0: trace_bidirectional and trace_analyse are added. By default a stream holds both directions of a conversation; 1.4.x returned one stream per direction.

Data Models

class pcapkit.interface.misc.Stream(filename, packets, conversations)[source]

Bases: Info

Data model for TCP streams.

filename: str | None

Output filename.

packets: tuple[Frame | PCAPNG | scapy.packet.Packet | dpkt.dpkt.Packet | pyshark.packet.packet.Packet | pcap_packet | Tuple[float, bytes], ...]

Packet list.

conversations: tuple[bytes | tuple[bytes, ...], ...]

TCP conversation.