2012-07-23 36 views
8

有沒有辦法使用scapy獲取數據包的到達時間?使用scapy讀取pcap文件,我想知道所有數據包的到達時間,因爲我們知道wireshark可以看到它。所以我想一定有辦法。有人知道嗎?scapy獲取數據包的到達時間

回答

14

使用pkt.time

[[email protected] icinga-1.7.1]$ sudo python 
[sudo] password for mpenning: 
Python 2.6.6 (r266:84292, Dec 26 2010, 22:31:48) 
[GCC 4.4.5] on linux2 
Type "help", "copyright", "credits" or "license" for more information. 
>>> from scapy.all import sniff 
WARNING: No route found for IPv6 destination :: (no default route?) 
>>> pkts = sniff(iface='eth0') 
^C>>> 
>>> pkts 
<Sniffed: TCP:2 UDP:8 ICMP:0 Other:4> 
>>> for pkt in pkts: 
...  print pkt.time 
... 
1343551962.73 
1343551963.28 
1343551963.28 
1343551963.32 
1343551963.32 
1343551963.36 
1343551963.4 
1343551963.45 
1343551963.55 
1343551963.65 
1343551963.75 
1343551963.85 
1343551963.85 
>>> 
+0

謝謝!我已經挖了幾個小時。順便說一句,它也在[這個線程](http://www.wireshark.org/lists/wireshark-dev/200808/msg00165.html)中討論,也可以參見[wireshark doc](http://wiki.wireshark.org /時間戳)。 – 2014-04-15 20:17:12