Fetch source address and port number of packet - Scapy script

问题

I am doing a sniffing of the network and trying to get ip address and port number on every tcp packet.

I used scapy with python and could successfully sniff packets and in a callback function could even print the packet summary. But I would want to do more, like fetching only the IP address of the source and its port number. How can i accomplish it? Below is my code:

#!/usr/bin/evn python
from scapy.all.import.*
def print_summary(pkt):
    packet = pkt.summary()
    print packet
sniff(filter="tcp",prn=packet_summary)

Please suggest a method to print only the source IP address of every packet.

Thanks.

回答1:

It is not very difficult. Try the following code:

#!/usr/bin/env python
from scapy.all import *
def print_summary(pkt):
    if IP in pkt:
        ip_src=pkt[IP].src
        ip_dst=pkt[IP].dst
    if TCP in pkt:
        tcp_sport=pkt[TCP].sport
        tcp_dport=pkt[TCP].dport

        print " IP src " + str(ip_src) + " TCP sport " + str(tcp_sport) 
        print " IP dst " + str(ip_dst) + " TCP dport " + str(tcp_dport)

    # you can filter with something like that
    if ( ( pkt[IP].src == "192.168.0.1") or ( pkt[IP].dst == "192.168.0.1") ):
        print("!")

sniff(filter="ip",prn=print_summary)
# or it possible to filter with filter parameter...!
sniff(filter="ip and host 192.168.0.1",prn=print_summary)

Enjoy!

回答2:

User2871462 has a terrific answer, I would comment on it but I don't have the required amount of reputation. :) The only thing I would add is that depending on the use case you may want to add the store=0 flag to the sniff call so you're not storing the packets. From the scapy docstring "store: wether to store sniffed packets or discard them".

sniff(filter="ip",prn=print_summary, store=0)

来源：https://stackoverflow.com/questions/19311673/fetch-source-address-and-port-number-of-packet-scapy-script