dpkt | simple packet creation / parsing , with definitions

import re

def get_packets(filename):
    with open(filename) as f:
        text = f.read()

    # Based on the sample file, packet continuations are over multiple lines
    # So split packets based on starting with a newline and then non-

$ curl -o vlan.cap.gz 'https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=vlan.cap.gz'
$ gunzip vlan.cap.gz

$ tshark -r vlan.cap -V
Frame 1: 1518 bytes on wire (12144 bits), 1518 byte

for timestamp, buf in capture:
    eth = dpkt.sll.SLL(buf)
    print("Ethernet: ", eth)
    ip = eth.data
    print("IP: ", ip)
    tcp = ip.data
    print("TCP: ", tcp)

for timestamp, buf in capture:
    eth = dpk

import dpkt
from functools import reduce
import socket

tflows = {}
uflows = {}
ips = set()

def dumpFlow(flows, flow):
    print(f'Data for flow: {flow}:')
    bytes = reduce(lambda x, y: x+y,
                   map(lambda e: e['byte_coun

$ python2 -c 'print(b"foo" == "foo")'
True

$ python3 -c 'print(b"foo" == "foo")'
False

import dpkt
with open("/tmp/dns.pcap", "rb") as f:
    pcap = dpkt.pcap.Reader(f)
    for ts, buf in pcap:
        l2 = dpkt.e

if not isinstance(value.flags, tcp_flags):
    continue

# determine if a connect scan takes place
def connect_scan_exist(packets):
  s = scan()
  # 1. grab all TCP syn
  for key, value in packets.items():
    # add

$ tshark -r dump -e tcp.srcport -Tjson
[
  {
    "_index": "packets-2019-04-14",
    "_type": "pcap_file",
    "_score": null,
    "_source": {
      "layers": {
        "tcp.srcport": [
          "42130"
        ]
      }
    }
  }
]

                if ip.p == dpkt.ip.IP_PROTO_TCP:
                    TCP = ip.data
                    iptype = 'tcp'
                    srcport = TCP.sport
                    dstport = TCP.dport
                elif ip.p == dpkt.ip.IP_P