April 2017
Intermediate to advanced
350 pages
8h 35m
English
It can be useful to know how to open pcap files, save new captures, and apply passive filters to. There are various ways we can proceed about this. Don't forget to call it in order to view the data. With scapy, you also have the option to choose the format for the data to be displayed in. Options include hex dump, hex strings, and even base64. Importing and exporting files will be helpful not only for later analysis, but also migrating data to other tools such as Wireshark because of its advanced interface and capability to process, organize, and dissect pcaps:
>>> packets = rdpcap("/temp/cap/savedpkc.cap")
>>> packets = sniff(offline="savedpkc.cap")
>>> wrpcap("savedpkc.cap",packet)
>>> packets=Ether()/IP(dst=Net("google.com/30")) ...Read now
Unlock full access