PyShark

PyShark is a wrapper for the Wireshark CLI (TShark), so we can have all Wireshark decoders in the PyShark. We can use PyShark to sniff an interface or we can analyze the pcap files.

Getting ready

When using this module, make sure to install Wireshark on your system and install pyshark using the pip command:

pip3 install pyshark

Also, make sure you have installed TShark on your machine. TShark is the terminal-based Wireshark, which is used by PyShark for packet capturing functions.

Note

Learn more about TShark here: https://www.wireshark.org/docs/wsug_html_chunked/AppToolstshark.html

How to do it...

Lets try PyShark with some examples. Make sure to install TShark in your system.

1. For a better understanding, we can use the Python interactive terminal and go through the functions of PyShark. Please note that these commands can also be included in the scripts. The only dependency is TShark.
2. Import the pyshark module:

>>> import pyshark

3. Now load the pcap file to pyshark:

>>> cap ...