from scapy.all import * from scapy.layers.inet import IP, UDP, TCP from scapy.layers.l2 import Ether def cut_packet(pkt): data = raw(pkt) if len(pkt) < 100: pad_len = 100 - len(pkt) pad = Padding() pad.load = '\x00' * pad_len pkt = pkt/pad if len(pkt) > 100: return Raw(data[:100]) return pkt def process(): pkts = rdpcap('vpn_aim_chat1a.pcap') i = 0 for pkt in pkts: # 只保留pair # target_pair = None # if UDP in pkt: # target_pair = UDP # if TCP in pkt: # target_pair = TCP # raw_data = pkt[target_pair].payload # pkt = IP(raw(raw_data)) # print(pkt.summary()) # 这个文件内的数据包没有数据链路层 # pkt[Ether].src = '00:00:00:00:00:00' # 将源MAC地址改为0x00 # pkt[Ether].dst = '00:00:00:00:00:00' # 将目标MAC地址改为0x00 pkt[IP].src = '0.0.0.0' # 将源IP地址改为0x00 pkt[IP].dst = '0.0.0.0' # 将目标IP地址改为0x00 if UDP in pkt: layer_after = pkt[UDP].payload.copy() pad = Padding() pad.load = '\x00' * 12 layer_before = pkt.copy() layer_before[UDP].remove_payload() pkt = layer_before / raw(pad) / layer_after pkt = cut_packet(pkt) wrpcap('output/packet_{0}.pcap'.format(i), [pkt]) i = i + 1 def read_pkt(filename: str): pkts = rdpcap(filename) print(pkts) # read_pkt("output/packet_1.pcap") process()