Question: how to process realtime pcap stream

[newinnovations]

Thanks for fixing #155.

I want to capture http traffic from a pod in kubernetes. For this I am running tcpdump in the pod and I am receiving the live pcap stream as stdout on my local computer and want to pipe it to a python script that will log the http requests and responses.

Is it possible PyPCAPKit will be reading pcap from stdin or a pipe and fire a callback each time a reassembled packet is found?

[JarryShaw]

Okay, PyPCAPKit may not support reading from stdin at the moment - as the fin argument is currently required to be a string-like filename. However, it is possible that you give a device name to this argument, if you're using a *NIX-like system and stdin is just nothing other than a special device.

I do agree that this argument should also accept file descriptors and/or objects.

And for the callback at each reassembled datagram, PyPCAPKit doesn't support that yet as well - despite the Reassembly.submit method is actually a built-in callback at the time of yielding reassembled datagram. It is possible for you to directly modify the code to insert your custom actions for the moment.

I'll work on these features soon and make a release targeting end of next week. Thanks for the ideas and feedback!

[newinnovations]

Looking forward to your new release. I am currently doing something along these lines using justniffer for the http reassembly:

cmd = (
    f"kubectl --context={CONTEXT} --namespace={NAMESPACE} exec {self.name} -- tcpdump -i eth0 -s 0 -w - -U'"
    "|"
    f"justniffer -f - -l ..."
)
p = Popen(["/bin/sh", "-c", cmd], stdout=PIPE, stderr=STDOUT)
for s in p.stdout:
    ...

Would be nice to have a pure python solution.

[JarryShaw]

I've made a 1.2.0 release to address the support of directly using any stream as fin parameter to the Extractor class. There might be some remaining edge cases with the support, especially within the implementation of the SeekableReader. Should you encounter any issue, feel free to leave a comment and/or open an issue.

Thanks for using PyPCAPKit!!!

[JarryShaw]

I've fixed a few issues related to SeekableReader handling stdin-like streams. Version 1.2.1 is the current-latest release to address these bugfix.