Packet Capture — tcpdump আর Wireshark দিয়ে সত্য দেখা

~110 লাইন, stdlib struct:

#!/usr/bin/env python3
"""read_pcap.py FILE — classic-pcap parser: eth→ip→tcp mini-table"""
import socket
import struct
import sys


def mac(b):
    return ':'.join(f'{x:02x}' for x in b)


def ipv4(b):
    return socket.inet_ntoa(b)


def decode_frame(frame):
    if len(frame) < 14:
        return None
    dst, src = frame[:6], frame[6:12]
    etype = int.from_bytes(frame[12:14], 'big')
    if etype != 0x0800:
        return ('non-ip', f'{mac(src)}>{mac(dst)} etype={etype:#06x}', '')
    ip = frame[14:]
    if len(ip) < 20:
        return None
    ihl = (ip[0] & 0x0F) * 4
    proto = ip[9]
    src, dst_ip = ipv4(ip[12:16]), ipv4(ip[16:20])
    l4 = ip[ihl:]
    if proto == 6 and len(l4) >= 20:                     # TCP
        sport, dport = struct.unpack('!HH', l4[:4])
        flags = l4[13]
        bits = [(flags & 0x01, 'F'), (flags & 0x02, 'S'), (flags & 0x04, 'R'),
                (flags & 0x08, 'P'), (flags & 0x10, 'A'), (flags & 0x20, 'U')]
        fl = ''.join(ch for bit, ch in bits if bit) or '.'
        seq = int.from_bytes(l4[4:8], 'big')
        return ('tcp', f'{src}.{sport} > {dst_ip}.{dport}', f'[{fl}] seq={seq}')
    if proto == 17 and len(l4) >= 8:                     # UDP
        sport, dport = struct.unpack('!HH', l4[:4])
        return ('udp', f'{src}.{sport} > {dst_ip}.{dport}', '')
    return ('other', f'{src} > {dst_ip}', f'proto={proto}')


def main(path):
    with open(path, 'rb') as fh:
        data = fh.read()

    magic = data[:4]
    if magic == b'\xa1\xb2\xc3\xd4':
        endian = '>'                                     # big-endian writer
    elif magic == b'\xd4\xc3\xb2\xa1':
        endian = '<'                                     # little-endian (common)
    elif magic == b'\x0a\x0d\x0d\x0a':
        sys.exit('pcapng detected — editcap -F pcap দিয়ে convert করুন')
    else:
        sys.exit(f'unrecognized magic {magic.hex()}')

    vmaj, vmin, _tz, _sig, snaplen, linktype = struct.unpack(
        endian + 'HHiIII', data[4:24])
    print(f'# pcap v{vmaj}.{vmin} snaplen={snaplen} '
          f'endian={"big" if endian == ">" else "little"}')
    if linktype != 1:
        sys.exit('# শুধু Ethernet (linktype 1) supported')

    off, n = 24, 0
    print(f'{"#":>3} {"timestamp":>15}  {"flow":<44} info')
    while off + 16 <= len(data):
        ts_sec, ts_usec, incl_len, orig_len = struct.unpack(
            endian + 'IIII', data[off:off + 16])
        off += 16
        frame = data[off:off + incl_len]
        off += incl_len
        n += 1
        decoded = decode_frame(frame)
        if decoded is None:
            continue
        kind, flow, info = decoded
        stamp = f'{ts_sec}.{ts_usec:06d}'
        trunc = ' SNAP-TRUNCATED' if incl_len < orig_len else ''
        print(f'{n:>3} {stamp:>15}  {kind:<5} {flow:<38} {info}{trunc}')
    print(f'# total packets: {n}')


if __name__ == '__main__':
    main(sys.argv[1] if len(sys.argv) > 1 else '/tmp/browse.pcap')

Verify against ground truth:

tcpdump -nn -r /tmp/browse.pcap | head -6
python3 read_pcap.py /tmp/browse.pcap | head -8
# flows, flags, seq — হুবহু মিলবে (timestamp formatting ভিন্ন, values এক)

Endianness-lesson-এর payoff: Mac (little-endian) আর old-Sparc (big-endian) writer-এর file এক parser-ই পড়ে — শুধু endian prefix বদলে।

নিজে বাড়ান: (১) UDP/DNS question-name decode; (২) truncated-TCP-header handling (incl_len < 54 guard); (৩) per-flow stats-dict; (৪) pcapng block-based global-header parse।