0

Anyone have a solution when using scapy to grab the tcp syn flags and store the source ip, destination ip, port number in a dictionary? I'm trying to build a tool that will take a pcap file and get that

This is what I've tired:

from scapy.all import PcapReader, TCP
from collections import Counter
count = Counter()
for pkt in PcapReader("testcapture.pcapng"):
    if TCP in pkt and pkt[TCP].flags & 2:  # TCP SYN packet
        src = pkt.sprintf('{IP:%IP.src%}')
        pkt.sprint
        count[src] += 1
        print(src)

This finds all the ips with syn flag, but i want to see port number

2

1 Answer 1

0

To access the port values in TCP layer you can use sport and dport. So you can adjust your code like this:

count = {}
for pkt in PcapReader("testcapture.pcapng"):
    if TCP in pkt and pkt[TCP].flags & 2:  # TCP SYN packet
        src = pkt.sprintf('{IP:%IP.src%}:{TCP:%TCP.sport%} -> {IP:%IP.dst%}:{TCP:%TCP.dport%}')
        pkt.sprint
        count[src] = count.get(src, 0) + 1
        print(src)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.