PyPCAPKit - Stream PCAP File Extractor¶
PyPCAPKit project is an open source Python program focus
on PCAP parsing and analysis, which works as a stream PCAP file extractor.
With support of
DictDumper, it shall support multiple
output report formats.
The whole project supports Python 3.6 or later.
- Module Documentation
- How to …
- Help Wanted
Unlike popular PCAP file extractors, such as
PyShark, and etc,
streaming strategy to read input files. That is to read frame by frame,
decrease occupation on memory, as well as enhance efficiency in some way.
pcapkit, all files can be described as following eight parts.
User interface for the
pcapkitlibrary, which standardises and simplifies the usage of this library.
Synthesises file I/O and protocol analysis, coordinates information exchange in all network layers, as well as provides the foundamental functions for
Collection of all protocol family, with detailed implementation and methods.
Auxiliary functions and tools for
Core utilities for
pcapkitimplementation, mainly for internal data structure and processing.
Auxiliary tools for
pcapkitto support the multiple extraction engines with a unified interface.
File output formatters for
Constant enumerations used in
pcapkitfor protocol family extraction and representation.
Due to the general overhead of
pcapkit, its extraction procedure takes
around 0.0008 seconds per packet, which is already impressive but not enough
comparing to other popular extration engines availbale on the market. Thus
pcapkit introduced alternative extractionengines to accelerate this
procedure. By now
pcapkit supports Scapy, DPKT, and PyShark.
Intel Core i7
Total Number of Cores
Performance (seconds per packet)
pcapkit supports Python versions since 3.6.
Simply run the following to install the current version from PyPI:
pip install pypcapkit
Or install the latest version from the gi repository:
git clone https://github.com/JarryShaw/PyPCAPKit.git cd pypcapkit pip install -e . # and to update at any time git pull
pcapkit supports various extraction engines, and extensive
plug-in functions, you may want to install the optional ones:
# for DPKT only pip install pypcapkit[DPKT] # for Scapy only pip install pypcapkit[Scapy] # for PyShark only pip install pypcapkit[PyShark] # and to install all the optional packages pip install pypcapkit[all] # or to do this explicitly pip install pypcapkit dpkt scapy pyshark
For CLI usage, you will need to install the optional packages:
pip install pypcapkit[cli] # or explicitly... pip install pypcapkit emoji