pyshark | Python wrapper for tshark , allowing python packet parsing | Learning library

You have to create empty Counter() before for-loop and later update this counter inside for-loop`

Minimla working code:

Instead of YOUR_MAC, YOUR_IP you have to get values from package.

you need to deduplicate the packets yourself, i.e. by storing past packet ip/mac combinations in a set

I found the reason for the incorrect nginx configuration. In the Dockerfile, I copied the nginx configuration file to the folder /etc/nginx. After that, I installed nginx via apt-get, which caused my configuration to be overwritten by the default configuration file.

Thus, the Dockerfile needed to be corrected by moving the COPY nginx.conf /etc/nginx behind the apt-get.

Corrected Dockerfile

I tried to use your code, but I couldn't get it to work correctly.

I know that there are some known issues with the way that capture.sniff(timeout=x) works, so I put together some other code that is using apply_on_packets with a timeout.

This AttributeError is being thrown, because this of this line:

A list of protocol numbers can be found here: https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml

Essentially we want to convert the protocol number to the name using python's builtin socket library like this question.

You want sniff(filter="tcp port 25565", prn=test).

Look at the scapy documentation.

We can add filtering to capture only packets that are interesting to us. Use standard tcpdump/libpcap syntax:

That syntax is specified in the pcap-filter man page.

qualifiers restrict the match to a particular protocol.
Possible protos are: ether, fddi, tr, wlan, ip, ip6, arp, rarp, decnet, tcp and udp. E.g., 'ether src foo', 'arp net 128.3', 'tcp port 21',

I don't think the syntax is well explained in it (or I'm not reading the right part), but as you can see, tcp port 21 is a valid filter and what you're looking for. For an alternative syntax that uses an and, you'll see this further down:

Primitives may be combined using: A parenthesized group of primitives and operators (parentheses are special to the Shell and must be escaped).
Negation ('!' or 'not').
Concatenation ('&&' or 'and').
Alternation ('||' or 'or').

As you can see, your filter options (or primitives) should be grouped using an operator. In this case, you want both to be true, so you want tcp and port 25565, or alternatively, tcp && port 25565.

Is this what you are trying to do?

Open config.ini file and change the tshark path to the path where your tshark.exe is located. (Worked for Windows) If this doesn't work try changing the dumpcap path also to the location where dumpcap.exe is stored.