how to make python read .pcap data captured by tcpdump with pipe on linux?

Question

Recently I manage to capture tcp data from my Raspberry Pi 3B+ Board to Wireshark on my local machine for realtime processing, but now I would like to capture the column "data" in "TCP" section with python in real time and send data of this columns via TCP port to another application listening on port 1234.

I think I try in a wrong way. My tries are shown below:

the command below make wireshark can analysis the tcp stream of another machine in realtime.

ssh [email protected] tcpdump -ns 0 -i eth0 "not port 22" | wireshark -k -i -

it works, and wireshark can work in real-time. I want to dump and display some data in every packet that match my requirement in terminal base on these command, so I try to filter my wanted column started by:

ssh [email protected] tcpdump -ns 0 -i eth0 "not port 22" | python test.py

and file test.py as show below:

import sys
k = 0
try:
   for line in iter(sys.stdin.readline, b''):
      k = k + 1
      print(line)
except KeyboardInterrupt:
   sys.stdout.flush()
   pass
print(k)

but just can not display anything.

by the way, the tcp stream is transport in binary mode.

I want to get some specified data in tcp data in real-time(or 90% real-time) capture by tcpdump, but I try some ways and won't work.

I also try to use the command that enable wireshark to analysis in real-time and then forward the data to python scripts, I search google for 2 days with zero results matched.

If anyone cool enough to help me with this? I'll be very grateful, Thank you!

al76 al76 · Accepted Answer · 2019-04-22T02:12:30

Here's a simple example of how to pipe to a python script.

import sys
import fileinput


incoming = fileinput.input(sys.argv[1:])
for line in incoming:
    print line.rstrip()

also python -u might help

-u     Force  stdin,  stdout  and  stderr to be totally unbuffered.  On
              systems where it matters, also put stdin, stdout and  stderr  in
              binary  mode.   Note  that there is internal buffering in xread‐
              lines(), readlines() and file-object  iterators  ("for  line  in
              sys.stdin")  which  is  not  influenced by this option.  To work
              around this, you will want to use "sys.stdin.readline()"  inside
              a "while 1:" loop.

how to make python read .pcap data captured by tcpdump with pipe on linux?

1 Answers