DOCSEARCHbyAlgolia
Submit Docs

PyPCAPKit: Comprehensive Network Packet Analysis Library

repository·main·Indexed 42 days ago

https://github.com/jarryshaw/pypcapkit

A Python library for deep packet dissection, reassembly, and flow tracing. It provides a detailed alternative to Scapy or DPKT, featuring a modular architecture for implementing custom protocols, extractor engines, and output dumpers. Supports exporting PCAP files to JSON, PLIST, and text tree formats via a Python API or the pcapkit-cli.

Tokens
81.8K
Snippets
176
Records
456
Agent score
53%

What's inside PyPCAPKit

  1. Overview of PyPCAPKit

    main

    PyPCAPKit is an open-source Python library designed for comprehensive network packet parsing, extraction, construction, and analysis. It is intended to be more detailed and more Pythonic than other popular extractors like Scapy, DPKT, or PyShark.

    Key Characteristics:

    • Comprehensive: Provides deep packet information, including reassembly and flow tracing (features often missing in faster engines).
    • Pythonic Interface: Designed for intuitive interaction with network data.
    • Extensible Engines: Supports multiple extraction engines to balance speed and depth.
    • Compatibility: Supports Python 3.6 or later.

  2. Overview of pcapkit.corekit utilities

    main

    The pcapkit.corekit module provides the foundational utility classes used throughout the pypcapkit implementation. It includes specialized data structures for metadata, protocol handling, and data parsing:

    • Data Mapping: MultiDict (inspired by Werkzeug) for handling dictionary-like data with multiple entries per key.
    • Metadata & Versioning: Info (a dict-like class) and VersionInfo (a tuple-like class) for managing object information and versioning.
    • Protocol Management: ProtoChain for managing collections of protocols.
    • Data Parsing: The Field family of classes for parsing wire data.
    • Context Management: ContextRegistry for providing caller-supplied information to protocols that is not present in the raw network traffic (wire data).

  3. Overview of the pcapkit.foundation module

    main

    The pcapkit.foundation module provides the core building blocks for the PyPCAPKit ecosystem. It contains essential tools for network packet analysis, including PCAP file extraction, TCP flow tracing, registry management, and TCP/IP reassembly implementations.

    Key components include:

    • pcapkit.foundation.extraction.Extractor: A tool for extracting data from PCAP files.
    • pcapkit.foundation.traceflow.traceflow.TraceFlow: A TCP flow tracer.
    • Registry management APIs used by the broader pcapkit library.
    • TCP/IP reassembly implementations.

  5. Access Link Layer protocols in PyPCAPKit

    main

    The pcapkit.protocols.link module serves as the central collection for all link layer protocols. It provides detailed implementations and methods for various link-level protocols. Supported protocols include, but are not limited to:

    • ethernet
    • arp (Address Resolution Protocol)
    • rarp (Reverse ARP)
    • l2tp / l2tpv2 (Layer 2 Tunneling Protocol)
    • ospf (Open Shortest Path First)
    • vlan (Virtual LAN)
    • c_tag / s_tag (VLAN Tagging)
    • dsl, eapol, fddi, isdn, ndp, and ppp (planned/implemented)

  7. Explore Internet Layer protocols in PyPCAPKit

    main

    The pcapkit.protocols.internet module provides a collection of implementations and methods for all protocols within the Internet Layer. This includes core IP protocols and various extension/security protocols.

    Supported protocols include:

    • IP/IPv6: ip, ipv4, ipv6, ipv6_frag, ipv6_opts, ipv6_route, hopopt
    • Security/Encapsulation: ipsec, ah, esp, hip, mh
    • Others: ipx, ecn, icmp, icmpv6, igmp, shim6

  8. Access constant enumerations in pcapkit.const

    main
    The pcapkit.const module serves as the central location for all constant enumerations used throughout the library. These constants are automatically generated from the pcapkit.vendor module and are organized by network layer and protocol type. Use this module to reference standardized protocol numbers and layer identifiers when performing packet analysis or filtering.

  9. Access IPv6 constant enumerations in pypcapkit

    main

    The pcapkit.const.ipv6 module provides a collection of constant enumerations used for implementing and interacting with IPv6 protocols. These enumerations are automatically generated from vendor definitions to ensure consistency with standard IPv6 parameters (such as those defined by IANA and RFCs).

    Available enumeration classes include:

    • ExtensionHeader: IPv6 Extension Header Types
    • Option: Destination Options and Hop-by-Hop Options
    • OptionAction: Option Actions
    • QSFunction: IPv6 QS Functions
    • RouterAlert: IPv6 Router Alert Option Values
    • Routing: IPv6 Routing Types
    • SeedID: Seed-ID Types
    • SMFDPDMode: Simplified Multicast Forwarding Duplicate Packet Detection (SMF_DPD) Options
    • TaggerID: Tagger-ID Types

  11. Explore pcapkit.utilities module components

    main

    The pcapkit.utilities module serves as the foundation for the library, providing core decorators, custom exceptions, and warnings. Key components include:

    • Decorators: Found in pcapkit.utilities.decorators, including seekset and beholder.
    • Error Handling: User-refined exceptions and warnings located in pcapkit.utilities.exceptions and pcapkit.utilities.warnings.
    • Other Utilities: Includes functools, logging, and chardet support.

  12. Access IPv4 constant enumerations in pypcapkit

    main

    The pcapkit.const.ipv4 module provides a collection of constant enumerations used for implementing and interacting with IPv4 protocols. These enumerations are automatically generated from vendor definitions to ensure consistency.

    Available enumerations include:

    • ClassificationLevel (via pcapkit.const.ipv4.classification_level.ClassificationLevel)
    • OptionClass (via pcapkit.const.ipv4.option_class.OptionClass)
    • OptionNumber (via pcapkit.const.ipv4.option_number.OptionNumber)
    • ProtectionAuthority (via pcapkit.const.ipv4.protection_authority.ProtectionAuthority)
    • QSFunction (via pcapkit.const.ipv4.qs_function.QSFunction)
    • RouterAlert (via pcapkit.const.ipv4.router_alert.RouterAlert)
    • ToSDelay (via pcapkit.const.ipv4.tos_del.ToSDelay)
    • ToSECN (via pcapkit.const.ipv4.tos_ecn.ToSECN)
    • ToSPrecedence (via pcapkit.const.ipv4.tos_pre.ToSPrecedence)
    • ToSReliability (via pcapkit.const.ipv4.tos_rel.ToSReliability)
    • ToSThroughput (via pcapkit.const.ipv4.tos_thr.ToSThroughput)
    • TSFlag (via pcapkit.const.ipv4.ts_flag.TSFlag)