PyShark Playground

Creating a PyShark Repository for Experimenting with Various Use Cases

If you’re eager to dive into network packet analysis using Python, setting up a PyShark repository is a great way to get started. I’ve created my own repo on Github to do some experimenting with PyShark use cases. You can find it here:

https://github.com/rbodnar75/pyshark-projects-playground

So . . . what is PyShark? PyShark is a wrapper for the Tshark part of Wireshark and allows you to capture and analyze network traffic with Python. If you are interested in experimenting with it yourself, here’s a simple guide to create a PyShark repo and explore different use cases.

Step 1: Setting Up the Environment

Before you begin, ensure you have Python installed on your system. You can download it from python.org.

Step 2: Installing Dependencies

You’ll need PyShark and Tshark. Install these using the following commands:

pip install pyshark
sudo apt-get install tshark

For Windows users, download Tshark from the Wireshark website.

Step 3: Creating the Repository

Initialize the Repo:
Create a new directory for your project and navigate into it:

   mkdir pyshark-experiments
   cd pyshark-experiments

Initialize a Git repository:

   git init

Set Up a Virtual Environment:
It’s best to work within a virtual environment to manage dependencies:

   python -m venv venv
   source venv/bin/activate  # On Windows use `venv\Scripts\activate`

Create a requirements.txt File:
List your project dependencies in this file:

   pyshark

Install the dependencies:

   pip install -r requirements.txt

Step 4: Writing Your First PyShark Script

Create a new Python script, capture_traffic.py, to capture network traffic:

import pyshark

# Capture live traffic on the default interface
capture = pyshark.LiveCapture(interface='eth0')

for packet in capture.sniff_continuously(packet_count=10):
    print(packet)

Replace 'eth0' with your network interface name.

Step 5: Experimenting with Use Cases

Now that your repository is set up, you can explore various use cases such as:

HTTP Traffic Analysis:
Capture and analyze HTTP packets:

   for packet in capture.sniff_continuously(packet_count=10):
       if 'HTTP' in packet:
           print(packet.http)

DNS Query Logging:
Capture DNS queries and log them:

   for packet in capture.sniff_continuously(packet_count=10):
       if 'DNS' in packet:
           print(packet.dns.qry_name)

Analyzing Specific Ports:
Filter traffic by specific ports (e.g., port 80 for HTTP):

   capture.set_debug()
   capture.apply_on_packets(lambda pkt: print(pkt), timeout=5, packet_count=10, bpf_filter='port 80')

Conclusion

By setting up a PyShark repository, you create a flexible environment to experiment with various network analysis use cases. Whether you’re analyzing HTTP traffic, logging DNS queries, or filtering by ports, PyShark provides a powerful toolkit for network packet analysis. Happy coding!

I hope this helps you get started with PyShark! If you have any questions or need further assistance, feel free to ask.