{"id":168,"date":"2024-12-05T18:48:55","date_gmt":"2024-12-05T18:48:55","guid":{"rendered":"http:\/\/www.rickbodnar.com\/?p=168"},"modified":"2024-12-05T18:48:55","modified_gmt":"2024-12-05T18:48:55","slug":"pyshark-playground","status":"publish","type":"post","link":"https:\/\/rickbodnar.com\/?p=168","title":{"rendered":"PyShark Playground"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\">Creating a PyShark Repository for Experimenting with Various Use Cases<\/h3>\n\n\n\n<p>If you&#8217;re eager to dive into network packet analysis using Python, setting up a PyShark repository is a great way to get started. I&#8217;ve created my own repo on Github to do some experimenting with PyShark use cases. You can find it here:<br><br><a href=\"https:\/\/github.com\/rbodnar75\/pyshark-projects-playground\">https:\/\/github.com\/rbodnar75\/pyshark-projects-playground<\/a><br><br>So . . .  what is PyShark? PyShark is a wrapper for the Tshark part of Wireshark and allows you to capture and analyze network traffic with Python. If you are interested in experimenting with it yourself, here&#8217;s a simple guide to create a PyShark repo and explore different use cases.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Step 1: Setting Up the Environment<\/h4>\n\n\n\n<p>Before you begin, ensure you have Python installed on your system. You can download it from <a href=\"https:\/\/www.python.org\/\">python.org<\/a>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Step 2: Installing Dependencies<\/h4>\n\n\n\n<p>You&#8217;ll need PyShark and Tshark. Install these using the following commands:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pip install pyshark\nsudo apt-get install tshark<\/code><\/pre>\n\n\n\n<p>For Windows users, download Tshark from the <a href=\"https:\/\/www.wireshark.org\/\">Wireshark website<\/a>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Step 3: Creating the Repository<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Initialize the Repo<\/strong>:<br>Create a new directory for your project and navigate into it:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>   mkdir pyshark-experiments\n   cd pyshark-experiments<\/code><\/pre>\n\n\n\n<p>Initialize a Git repository:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>   git init<\/code><\/pre>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li><strong>Set Up a Virtual Environment<\/strong>:<br>It&#8217;s best to work within a virtual environment to manage dependencies:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>   python -m venv venv\n   source venv\/bin\/activate  # On Windows use `venv\\Scripts\\activate`<\/code><\/pre>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li><strong>Create a <code>requirements.txt<\/code> File<\/strong>:<br>List your project dependencies in this file:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>   pyshark<\/code><\/pre>\n\n\n\n<p>Install the dependencies:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>   pip install -r requirements.txt<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Step 4: Writing Your First PyShark Script<\/h4>\n\n\n\n<p>Create a new Python script, <code>capture_traffic.py<\/code>, to capture network traffic:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import pyshark\n\n# Capture live traffic on the default interface\ncapture = pyshark.LiveCapture(interface='eth0')\n\nfor packet in capture.sniff_continuously(packet_count=10):\n    print(packet)<\/code><\/pre>\n\n\n\n<p>Replace <code>'eth0'<\/code> with your network interface name.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Step 5: Experimenting with Use Cases<\/h4>\n\n\n\n<p>Now that your repository is set up, you can explore various use cases such as:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>HTTP Traffic Analysis<\/strong>:<br>Capture and analyze HTTP packets:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>   for packet in capture.sniff_continuously(packet_count=10):\n       if 'HTTP' in packet:\n           print(packet.http)<\/code><\/pre>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li><strong>DNS Query Logging<\/strong>:<br>Capture DNS queries and log them:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>   for packet in capture.sniff_continuously(packet_count=10):\n       if 'DNS' in packet:\n           print(packet.dns.qry_name)<\/code><\/pre>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li><strong>Analyzing Specific Ports<\/strong>:<br>Filter traffic by specific ports (e.g., port 80 for HTTP):<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>   capture.set_debug()\n   capture.apply_on_packets(lambda pkt: print(pkt), timeout=5, packet_count=10, bpf_filter='port 80')<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Conclusion<\/h4>\n\n\n\n<p>By setting up a PyShark repository, you create a flexible environment to experiment with various network analysis use cases. Whether you&#8217;re analyzing HTTP traffic, logging DNS queries, or filtering by ports, PyShark provides a powerful toolkit for network packet analysis. Happy coding!<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p>I hope this helps you get started with PyShark! If you have any questions or need further assistance, feel free to ask. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Creating a PyShark Repository for Experimenting with Various Use Cases If you&#8217;re eager to dive into network packet analysis using Python, setting up a PyShark repository is a great way to get started. I&#8217;ve created my own repo on Github to do some experimenting with PyShark use cases. You can find it here: https:\/\/github.com\/rbodnar75\/pyshark-projects-playground So [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[2,13,14],"tags":[],"class_list":["post-168","post","type-post","status-publish","format-standard","hentry","category-networking-concepts","category-python","category-scripting"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p91cKS-2I","jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/rickbodnar.com\/index.php?rest_route=\/wp\/v2\/posts\/168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rickbodnar.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rickbodnar.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rickbodnar.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rickbodnar.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=168"}],"version-history":[{"count":1,"href":"https:\/\/rickbodnar.com\/index.php?rest_route=\/wp\/v2\/posts\/168\/revisions"}],"predecessor-version":[{"id":169,"href":"https:\/\/rickbodnar.com\/index.php?rest_route=\/wp\/v2\/posts\/168\/revisions\/169"}],"wp:attachment":[{"href":"https:\/\/rickbodnar.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rickbodnar.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rickbodnar.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}