如何从网络数据包中提取出应用层协议?

新手上路,请多包涵

如何从网络数据包中提取出应用层协议?

我希望通过协议名来过滤rtp/rtsp协议,但是无论是tshark和tcpdump似乎很难达到我的目的,我的代码如下:

def producer(q):
    try:
        tcpdump_process = subprocess.Popen(
            ["tcpdump", "-i", str(wangkaname), "-U", "-s", "65535", "-w", "-"],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
        )
        try:
            pcap_header = tcpdump_process.stdout.read(24)
            if pcap_header[:4] == b"\xa1\xb2\xc3\xd4":  # big-endian
                typeI = "!I"
                typeH = "!H"
            elif pcap_header[:4] == b"\xd4\xc3\xb2\xa1":  # little-endian
                typeI = "I"
                typeH = "H"
            else:
                raise ValueError("Unknown pcap file format")
            reader = PacketReader("../dataset/realdiswangka.csv")

            while True:
                try:
                    packet_header = tcpdump_process.stdout.read(16)
                    if not packet_header:
                        if tcpdump_process.poll() is not None:
                            break
                        continue
                    timeHigh = struct.unpack(typeI, packet_header[0:4])[0]
                    timeLow = struct.unpack(typeI, packet_header[4:8])[0]
                    timeStamp = 1000000 * timeHigh + timeLow
                    ts_sec, ts_usec, incl_len, orig_len = struct.unpack(
                        typeI + typeI + typeI + typeI, packet_header
                    )
                    packet_data = tcpdump_process.stdout.read(incl_len)
                    basicPacket = reader.get_ipv4_info(packet_data, timeStamp)

                    if basicPacket:
                        q.put(basicPacket)
                except Exception as e:
                    print(f"发生了未知的错误: {e}")
        except Exception as e:
            print(f"发生了未知的错误: {e}")
        finally:
            tcpdump_process.terminate()
            tcpdump_process.wait()
    except Exception as e:
        print(f"发生了未知的错误: {e}")

现在我希望在获取到数据包basicPacket后,是否可以从数据包中获取应用层协议? 有没有什么办法?

阅读 620
撰写回答
你尚未登录,登录后可以
  • 和开发者交流问题的细节
  • 关注并接收问题和回答的更新提醒
  • 参与内容的编辑和改进,让解决方法与时俱进
推荐问题
宣传栏