pyshark安装使用,ubuntu:20.04

1.容器创建

命令 docker run -d --name pyshark -v D:\src:/root/share ubuntu:2004 /bin/bash -c "while true;do sleep 1000;done" 用于创建并启动一个新的 Docker 容器。

bash 复制代码
docker run -d --name pyshark -v D:\src:/root/share ubuntu:2004 /bin/bash -c "while true;do sleep 1000;done"
5bd3f36da18ef4cf158ef021ed411a53cb5b5ea65e306c6c03025e26b1f5553c

2.进入容器

命令 docker exec -it pyshark /bin/bash 用于进入一个正在运行的 Docker 容器,并启动一个交互式的 Bash shell 会话

bash 复制代码
 docker exec -it pyshark /bin/bash

3.更新安装

apt update

作用:更新软件包列表。

解释:apt update 命令会从配置的软件源(通常是 /etc/apt/sources.list 和 /etc/apt/sources.list.d/ 目录下的文件)获取最新的软件包信息,并更新本地的软件包索引。这是安装新软件包或升级现有软件包之前的一个必要步骤。

apt install -y python3-pip

作用:安装 python3-pip 包。

解释:

apt install 命令用于安装指定的软件包。

-y 标志表示自动确认所有提示(即自动回答"是"),这样可以避免在自动化脚本中出现交互式提示。

python3-pip 是 Python 3 的 pip 包管理器。pip 是一个用于安装和管理 Python 包的工具。

pip install pyshark

作用:使用 pip 安装 pyshark 库。

解释:

pip 是 Python 的包管理器,用于安装和管理 Python 包。

install 命令用于安装指定的包。
pyshark 是一个 Python 库,用于解析网络数据包,它依赖于 libpcap 和 tshark(Wireshark 的命令行工具)。

bash 复制代码
apt update
apt install -y python3-pip
pip install pyshark

4.安装tshark,时区选择亚洲上海(6和70),后面yes,即非root可以运行。

bash 复制代码
apt update
apt install -y tshark

到此安装完成

解析pcap文件(下载链接)【免费】mqtt等协议的pcap文件资源-CSDN文库

python代码

python 复制代码
import pyshark
 
# 读取PCAP文件
pcap_file = 'exported_tr01.pcap'  # 替换为你的PCAP文件路径
cap = pyshark.FileCapture(pcap_file)
 
# 遍历数据包并提取FTP数据包
mqtt_packets = []
for packet in cap:
    if 'MQTT' in packet:
        mqtt_packets.append(packet)
 
# 输出FTP数据包
for mqtt_packet in mqtt_packets:
    print(mqtt_packet)

结果:

命令:tshark -r exported_tr01.pcap -Y "mqtt"

python 复制代码
root@5bd3f36da18e:~/share/tshark_py# tshark -r exported_tr01.pcap -Y "mqtt"
Running as user "root" and group "root". This could be dangerous.
    4   0.096000  10.21.56.15 ? 8.137.154.246 MQTT 91 Connect Command
    6   0.149000 8.137.154.246 ? 10.21.56.15  MQTT 58 Connect Ack
    9   0.396000 8.137.154.246 ? 10.21.56.15  MQTT 58 [TCP Spurious Retransmission] , Connect Ack
   13   0.434000  10.21.56.15 ? 8.137.154.246 MQTT 105 Connect Command
   15   0.519000 8.137.154.246 ? 10.21.56.15  MQTT 58 Connect Ack
   17   0.787000  10.21.56.15 ? 8.137.154.246 MQTT 91 Subscribe Request (id=26163) [hello101] [hello102] [hello103]
   18   0.835000 8.137.154.246 ? 10.21.56.15  MQTT 61 Subscribe Ack (id=26163)
   19   0.835000 8.137.154.246 ? 10.21.56.15  MQTT 68 Publish Message [hello101]
   21   1.264000  10.21.56.15 ? 8.137.154.246 MQTT 69 Subscribe Request (id=44324) [hello103]
   22   1.321000 8.137.154.246 ? 10.21.56.15  MQTT 59 Subscribe Ack (id=44324)
   24   1.552000  10.21.56.15 ? 8.137.154.246 MQTT 69 Subscribe Request (id=44325) [hello103]
   25   1.615000 8.137.154.246 ? 10.21.56.15  MQTT 59 Subscribe Ack (id=44325)
   27   1.908000  10.21.56.15 ? 8.137.154.246 MQTT 82 Subscribe Request (id=26164) [cx001] [cx111] [cx221]
   28   1.968000 8.137.154.246 ? 10.21.56.15  MQTT 61 Subscribe Ack (id=26164)
   30   2.201000  10.21.56.15 ? 8.137.154.246 MQTT 125 Subscribe Request (id=26165) [123456789abcdefghijklmnopqrstuvwxyz ABCDEFGHIJKLMNOPQRSTUVWXY\0Z]
   31   2.251000 8.137.154.246 ? 10.21.56.15  MQTT 59 Subscribe Ack (id=26165)
   33   2.479000  10.21.56.15 ? 8.137.154.246 MQTT 65 Unsubscribe Request (id=26166)
   34   2.532000 8.137.154.246 ? 10.21.56.15  MQTT 58 Unsubscribe Ack (id=26166)
   36   2.779000  10.21.56.15 ? 8.137.154.246 MQTT 79 Unsubscribe Request (id=26167)
   37   2.816000 8.137.154.246 ? 10.21.56.15  MQTT 58 Unsubscribe Ack (id=26167)
   39   3.050000  10.21.56.15 ? 8.137.154.246 MQTT 124 Unsubscribe Request (id=26168)
   40   3.128000 8.137.154.246 ? 10.21.56.15  MQTT 58 Unsubscribe Ack (id=26168)
   42   3.379000  10.21.56.15 ? 8.137.154.246 MQTT 318 Subscribe Request (id=26169)[Packet size limited during capture]
   43   3.436000 8.137.154.246 ? 10.21.56.15  MQTT 59 Subscribe Ack (id=26169)
   45   3.715000  10.21.56.15 ? 8.137.154.246 MQTT 70 Subscribe Request (id=26170) [hello103c]
   46   3.768000 8.137.154.246 ? 10.21.56.15  MQTT 59 Subscribe Ack (id=26170)
   48   3.984000  10.21.56.15 ? 8.137.154.246 MQTT 321 Subscribe Request (id=26171)[Packet size limited during capture]
   49   4.053000 8.137.154.246 ? 10.21.56.15  MQTT 59 Subscribe Ack (id=26171)
   51   4.332000  10.21.56.15 ? 8.137.154.246 MQTT 68 Unsubscribe Request (id=44326)
   52   4.385000 8.137.154.246 ? 10.21.56.15  MQTT 58 Unsubscribe Ack (id=44326)
   53   4.517000  10.21.56.15 ? 8.137.154.246 MQTT 67 Publish Message [hello103c]
   54   4.570000 8.137.154.246 ? 10.21.56.15  MQTT 67 Publish Message [hello103c]
   57   4.686000 8.137.154.246 ? 10.21.56.15  MQTT 58 [TCP Spurious Retransmission] , Unsubscribe Ack (id=44326)
   59   4.940000  10.21.56.15 ? 8.137.154.246 MQTT 246 Publish Message (id=26173) [hello103c][Packet size limited during capture]
   60   4.987000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Ack (id=26173)
   61   4.987000 8.137.154.246 ? 10.21.56.15  MQTT 244 Publish Message [hello103c][Packet size limited during capture]
   63   5.341000  10.21.56.15 ? 8.137.154.246 MQTT 1037 Publish Message (id=26174) [hello103c][Packet size limited during capture]        
   64   5.435000 8.137.154.246 ? 10.21.56.15  MQTT 1039 Publish Ack (id=26174), Publish Message [hello103c][Packet size limited during capture]
   66   5.742000  10.21.56.15 ? 8.137.154.246 MQTT 1454 Publish Message (id=26175) [hello103c][Malformed Packet: length of contained item exceeds length of containing item]
   67   5.742000  10.21.56.15 ? 8.137.154.246 MQTT 663 Publish Message[Unreassembled Packet], Connect Ack
   69   5.809000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Ack (id=26175)
   70   5.810000 8.137.154.246 ? 10.21.56.15  MQTT 1454 Publish Message [hello103c][Malformed Packet: length of contained item exceeds length of containing item]
   71   5.810000 8.137.154.246 ? 10.21.56.15  MQTT 661 Publish Received (id=13865), Publish Release (id=18046)
   74   6.042000  10.21.56.15 ? 8.137.154.246 MQTT 70 Publish Message [hello101]
   75   6.089000 8.137.154.246 ? 10.21.56.15  MQTT 70 Publish Message [hello101]
   77   6.437000  10.21.56.15 ? 8.137.154.246 MQTT 66 Publish Message [hello101]
   78   6.475000 8.137.154.246 ? 10.21.56.15  MQTT 66 Publish Message [hello101]
   80   6.722000  10.21.56.15 ? 8.137.154.246 MQTT 113 Publish Message [hello103]
   81   6.776000 8.137.154.246 ? 10.21.56.15  MQTT 113 Publish Message [hello103]
   83   7.061000  10.21.56.15 ? 8.137.154.246 MQTT 115 Publish Message (id=26179) [hello103]
   84   7.139000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Ack (id=26179)
   85   7.139000 8.137.154.246 ? 10.21.56.15  MQTT 115 Publish Message (id=1) [hello103]
   87   7.208000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Ack (id=1)
   89   7.346000  10.21.56.15 ? 8.137.154.246 MQTT 176 Publish Message [hello101][Packet size limited during capture]
   91   7.393000 8.137.154.246 ? 10.21.56.15  MQTT 176 Publish Message [hello101][Packet size limited during capture]
   93   7.624000  10.21.56.15 ? 8.137.154.246 MQTT 178 Publish Message (id=26181) [hello101][Packet size limited during capture]
   94   7.693000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Ack (id=26181)
   95   7.693000 8.137.154.246 ? 10.21.56.15  MQTT 176 Publish Message [hello101][Packet size limited during capture]
   97   7.894000  10.21.56.15 ? 8.137.154.246 MQTT 74 Publish Message (id=26182) [hello101]
   98   7.947000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Received (id=26182)
   99   7.947000 8.137.154.246 ? 10.21.56.15  MQTT 72 Publish Message [hello101]
  101   8.025000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Release (id=26182)
  102   8.079000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Complete (id=26182)
  104   8.179000  10.21.56.15 ? 8.137.154.246 MQTT 178 Publish Message (id=26183) [hello101][Packet size limited during capture]
  105   8.248000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Received (id=26183)
  106   8.248000 8.137.154.246 ? 10.21.56.15  MQTT 176 Publish Message [hello101][Packet size limited during capture]
  108   8.316000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Release (id=26183)
  109   8.363000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Complete (id=26183)
  111   8.464000  10.21.56.15 ? 8.137.154.246 MQTT 176 Publish Message [hello102][Packet size limited during capture]
  112   8.511000 8.137.154.246 ? 10.21.56.15  MQTT 176 Publish Message [hello102][Packet size limited during capture]
  114   8.742000  10.21.56.15 ? 8.137.154.246 MQTT 178 Publish Message (id=26185) [hello102][Packet size limited during capture]
  115   8.811000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Ack (id=26185)
  116   8.811000 8.137.154.246 ? 10.21.56.15  MQTT 178 Publish Message (id=2) [hello102][Packet size limited during capture]
  118   8.896000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Ack (id=2)
  120   9.065000  10.21.56.15 ? 8.137.154.246 MQTT 73 Publish Message (id=26186) [hello102]
  122   9.128000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Received (id=26186)
  123   9.128000 8.137.154.246 ? 10.21.56.15  MQTT 73 Publish Message (id=3) [hello102]
  125   9.202000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Release (id=26186)
  126   9.212000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Ack (id=3)
  127   9.243000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Complete (id=26186)
  130   9.572000  10.21.56.15 ? 8.137.154.246 MQTT 178 Publish Message (id=26187) [hello102][Packet size limited during capture]
  132   9.625000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Received (id=26187)
  133   9.625000 8.137.154.246 ? 10.21.56.15  MQTT 178 Publish Message (id=4) [hello102][Packet size limited during capture]
  135   9.710000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Release (id=26187)
  136   9.725000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Ack (id=4)
  138   9.768000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Complete (id=26187)
  139   9.850000  10.21.56.15 ? 8.137.154.246 MQTT 176 Publish Message [hello103][Packet size limited during capture]
  140   9.925000 8.137.154.246 ? 10.21.56.15  MQTT 176 Publish Message [hello103][Packet size limited during capture]
  141  10.126000  10.21.56.15 ? 8.137.154.246 MQTT 178 Publish Message (id=26189) [hello103][Packet size limited during capture]
  142  10.195000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Ack (id=26189)
  143  10.195000 8.137.154.246 ? 10.21.56.15  MQTT 178 Publish Message (id=5) [hello103][Packet size limited during capture]
  145  10.273000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Ack (id=5)
  147  10.411000  10.21.56.15 ? 8.137.154.246 MQTT 178 Publish Message (id=26190) [hello103][Packet size limited during capture]
  149  10.474000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Received (id=26190)
  150  10.474000 8.137.154.246 ? 10.21.56.15  MQTT 178 Publish Message (id=6) [hello103][Packet size limited during capture]
  152  10.558000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Release (id=26190)
  153  10.574000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Received (id=6)
  154  10.627000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Complete (id=26190)
  155  10.643000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Release (id=6)
  157  10.728000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Complete (id=6)
  158  10.743000  10.21.56.15 ? 8.137.154.246 MQTT 179 Publish Message (id=26191) [hello101][Packet size limited during capture]
  160  10.797000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Received (id=26191)
  161  10.797000 8.137.154.246 ? 10.21.56.15  MQTT 177 Publish Message [hello101][Packet size limited during capture]
  163  10.875000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Release (id=26191)
  164  10.928000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Complete (id=26191)
  165  11.028000  10.21.56.15 ? 8.137.154.246 MQTT 1093 Publish Message (id=26192) [hello103][Packet size limited during capture]
  166  11.097000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Ack (id=26192)
  167  11.097000 8.137.154.246 ? 10.21.56.15  MQTT 1093 Publish Message (id=7) [hello103][Packet size limited during capture]
  169  11.175000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Ack (id=7)
  171  11.414000  10.21.56.15 ? 8.137.154.246 MQTT 1093 Publish Message (id=26193) [hello103][Packet size limited during capture]
  173  11.476000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Ack (id=26193)
  174  11.476000 8.137.154.246 ? 10.21.56.15  MQTT 1093 Publish Message (id=8) [hello103][Packet size limited during capture]
  176  11.561000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Ack (id=8)
  178  11.746000  10.21.56.15 ? 8.137.154.246 MQTT 70 Publish Message (id=26194) [hello103]
  180  11.799000 8.137.154.246 ? 10.21.56.15  MQTT 74 Publish Ack (id=26194), Publish Message (id=9) [hello103]
  181  11.877000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Ack (id=9)
  183  12.378000  10.21.56.15 ? 8.137.154.246 MQTT 1093 Publish Message (id=26195) [hello103][Packet size limited during capture]
  185  12.447000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Ack (id=26195)
  186  12.447000 8.137.154.246 ? 10.21.56.15  MQTT 1093 Publish Message (id=10) [hello103][Packet size limited during capture]
  188  12.532000  10.21.56.15 ? 8.137.154.246 MQTT 58 Publish Ack (id=10)
  189  12.648000  10.21.56.15 ? 8.137.154.246 MQTT 78 Publish Message (id=26196) [hello1retain1]
  192  12.694000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Ack (id=26196)
  194  12.933000  10.21.56.15 ? 8.137.154.246 MQTT 74 Subscribe Request (id=26197) [hello1retain1]
  195  12.995000 8.137.154.246 ? 10.21.56.15  MQTT 81 Subscribe Ack (id=26197), Publish Message [hello1retain1]
  197  13.218000  10.21.56.15 ? 8.137.154.246 MQTT 78 Publish Message (id=26198) [hello1retain0]
  198  13.249000 8.137.154.246 ? 10.21.56.15  MQTT 58 Publish Ack (id=26198)
  200  13.496000  10.21.56.15 ? 8.137.154.246 MQTT 74 Subscribe Request (id=26199) [hello1retain0]
  201  13.534000 8.137.154.246 ? 10.21.56.15  MQTT 59 Subscribe Ack (id=26199)
  205  23.706000  10.21.56.15 ? 8.137.154.246 MQTT 67 Publish Message [hello103c]
  206  23.759000 8.137.154.246 ? 10.21.56.15  MQTT 67 Publish Message [hello103c]
  207  23.975000  10.21.56.15 ? 8.137.154.246 MQTT 71 Publish Message [hello103]
  208  24.029000 8.137.154.246 ? 10.21.56.15  MQTT 71 Publish Message [hello103]
  210  24.323000  10.21.56.15 ? 8.137.154.246 MQTT 70 Publish Message [hello103]
  211  24.392000 8.137.154.246 ? 10.21.56.15  MQTT 70 Publish Message [hello103]
  213  24.608000  10.21.56.15 ? 8.137.154.246 MQTT 72 Publish Message [hello103]
  214  24.646000 8.137.154.246 ? 10.21.56.15  MQTT 72 Publish Message [hello103]
  216  24.877000  10.21.56.15 ? 8.137.154.246 MQTT 323 Publish Message [hello103][Packet size limited during capture]
  217  24.962000 8.137.154.246 ? 10.21.56.15  MQTT 323 Publish Message [hello103][Packet size limited during capture]
  219  25.278000  10.21.56.15 ? 8.137.154.246 MQTT 70 Publish Message [hello103]
  220  25.325000 8.137.154.246 ? 10.21.56.15  MQTT 70 Publish Message [hello103]
  226  47.349000  10.21.56.15 ? 8.137.154.246 MQTT 56 Disconnect Req
  227  47.403000  10.21.56.15 ? 8.137.154.246 MQTT 56 Disconnect Req

MQTT(Message Queuing Telemetry Transport)协议的数据包通常包含多个层次。在你提供的数据包分析中,我们可以看到该数据包包含了多个层次,每个层次负责不同的功能。下面是对各个层次的详细解释:

1. 以太网层 (ETH)

Destination: 00:00:00:00:00:00

Source: 00:00:00:00:00:00

Type: IPv4 (0x0800)

以太网层负责物理地址的传输,确保数据包能够在局域网内正确传输。这里的源和目的MAC地址都是全零,这通常表示无效或未设置的地址。

2. IP层 (IP)

Version: 4

Header Length: 20 bytes (5)

Differentiated Services Field: 0x04 (DSCP: LE, ECN: Not-ECT)

Total Length: 53

Identification: 0x0f00 (3840)

Flags: 0x4000, Don't fragment

Fragment offset: 0

Time to live: 49

Protocol: TCP (6)

Header checksum: 0x551c [validation disabled]

Source: 8.137.154.246

Destination: 10.21.56.15

IP层负责在网络层传输数据包,确保数据包能够从源地址到达目的地址。这里可以看到源IP地址是 8.137.154.246,目的IP地址是 10.21.56.15。

3. TCP层 (TCP)

Source Port: 1883

Destination Port: 64033

Sequence number: 7939 (relative sequence number)

Acknowledgment number: 8748 (relative ack number)

Header Length: 20 bytes (5)

Flags: 0x018 (PSH, ACK)

Window size value: 378

Checksum: 0x4d14 [unverified]

Urgent pointer: 0

TCP层负责提供可靠的端到端通信。这里可以看到源端口是 1883,这是MQTT协议的默认端口。目的端口是 64033。TCP标志位 PSH 和 ACK 表示这是一个带有推送标志的确认数据包。

4. MQTT层 (MQTT)

Header Flags: 0x30, Message Type: Publish Message, QoS Level: At most once delivery (Fire and Forget)

Msg Len: 11

Topic Length: 9

Topic: hello103c

Message: <MISSING>

MQTT层负责实际的MQTT消息传输。这里可以看到这是一个发布消息(Publish Message),QoS级别为0,表示"最多一次"交付(Fire and Forget)。主题(Topic)是 hello103c,但消息内容缺失。

总结

以太网层:处理物理地址和局域网内的传输。

IP层:处理网络层的传输,确保数据包从源地址到达目的地址。

TCP层:提供可靠的端到端通信。

MQTT层:处理MQTT协议的消息传输,包括发布、订阅等操作。

相关推荐
特立独行的猫a9 分钟前
redis客户端库redis++在嵌入式Linux下的交叉编译及使用
linux·数据库·c++·redis·redis客户端库
无敌小茶35 分钟前
Linux学习笔记之环境变量
linux·笔记
Harbor Lau1 小时前
Linux常用中间件命令大全
linux·运维·中间件
漫谈网络1 小时前
基于 Netmiko 的网络设备自动化操作
运维·自动化·netdevops·netmiko
꧁坚持很酷꧂2 小时前
Linux Ubuntu18.04下安装Qt Craeator 5.12.9(图文详解)
linux·运维·qt
凉、介2 小时前
PCI 总线学习笔记(五)
android·linux·笔记·学习·pcie·pci
电鱼智能的电小鱼2 小时前
EFISH-SBC-RK3588无人机地面基准站项目
linux·网络·嵌入式硬件·机器人·无人机·边缘计算
foo1st2 小时前
Tomcat Web应用(Ubuntu 18.04.6 LTS)部署笔记
ubuntu·tomcat
电鱼智能的电小鱼2 小时前
基于 EFISH-SBC-RK3588 的无人机环境感知与数据采集方案
linux·网络·嵌入式硬件·数码相机·无人机·边缘计算
小诸葛的博客3 小时前
详解Linux中的定时任务管理工具crond
linux·运维·chrome