Techzone/PyShark - Python Packet Analysis

PyShark - Python Packet Analysis

2 min readArticle

PyShark is a Python wrapper for TShark (Wireshark's CLI). It lets you parse and analyze pcap files or live captures using Python — applying Wireshark display filters, accessing packet fields, and automating analysis. Great for processing large captures, building custom detection scripts, and extracting specific data programmatically.

Installation

bash 
pip install pyshark

# Requires tshark to be installed
sudo apt install tshark

Basic Usage

python 
import pyshark

# Read from pcap file
cap = pyshark.FileCapture('capture.pcap')

# Iterate packets
for packet in cap:
    print(packet)
    break  # Just first packet

cap.close()

Accessing Packet Fields

python 
import pyshark

cap = pyshark.FileCapture('capture.pcap')

for packet in cap:
    try:
        # IP fields
        if hasattr(packet, 'ip'):
            print(f"Src: {packet.ip.src} → Dst: {packet.ip.dst}")
        
        # TCP fields
        if hasattr(packet, 'tcp'):
            print(f"Port: {packet.tcp.dstport}")
        
        # HTTP fields
        if hasattr(packet, 'http'):
            print(f"Host: {packet.http.host}")
            if hasattr(packet.http, 'request_uri'):
                print(f"URI: {packet.http.request_uri}")
    
    except AttributeError:
        pass

cap.close()

Display Filters

python 
# Apply Wireshark display filter when opening
cap = pyshark.FileCapture('capture.pcap', display_filter='http')
cap = pyshark.FileCapture('capture.pcap', display_filter='tcp.port == 443')
cap = pyshark.FileCapture('capture.pcap', display_filter='dns')
cap = pyshark.FileCapture('capture.pcap', display_filter='eapol')  # WPA handshakes

Live Capture

python 
import pyshark

# Live capture on interface
cap = pyshark.LiveCapture(interface='eth0')

# With display filter
cap = pyshark.LiveCapture(interface='eth0', display_filter='tcp port 80')

# Process live packets
for packet in cap.sniff_continuously(packet_count=50):
    print(f"[{packet.sniff_time}] {packet}")

Practical Examples

Extract DNS Queries

python 
import pyshark

cap = pyshark.FileCapture('capture.pcap', display_filter='dns.flags.response == 0')

print("DNS Queries:")
for packet in cap:
    try:
        print(f"  {packet.ip.src} queried: {packet.dns.qry_name}")
    except AttributeError:
        pass

cap.close()

Extract HTTP Credentials

python 
import pyshark

cap = pyshark.FileCapture('capture.pcap', display_filter='http.authorization')

for packet in cap:
    try:
        print(f"Auth header: {packet.http.authorization}")
    except AttributeError:
        pass

Find WiFi SSIDs from Beacons

python 
import pyshark

cap = pyshark.FileCapture('wifi.pcap', display_filter='wlan.fc.subtype == 8')

ssids = set()
for packet in cap:
    try:
        ssid = packet.wlan_mgt.ssid
        bssid = packet.wlan.bssid
        ssids.add((ssid, bssid))
    except AttributeError:
        pass

for ssid, bssid in sorted(ssids):
    print(f"SSID: {ssid:30s} BSSID: {bssid}")

Detect Deauth Storms

python 
import pyshark
from collections import Counter

cap = pyshark.FileCapture('wifi.pcap', display_filter='wlan.fc.type_subtype == 12')

sources = Counter()
for packet in cap:
    try:
        sources[packet.wlan.ta] += 1
    except AttributeError:
        pass

print("Deauth frames by source (possible attackers):")
for mac, count in sources.most_common(10):
    print(f"  {mac}: {count} frames")

Performance Tips

  • only_summaries=True is much faster if you don't need full field access
  • keep_packets=False prevents accumulating memory
  • Use display filters to reduce what's loaded
  • For huge pcaps, consider tshark directly for speed

See Also

  • tshark-cli-guide - The underlying tool PyShark wraps
  • tcpdump-packet-capture - Simpler capture option
  • scapy-packet-crafting - For crafting + injecting packets, not just analysis
techzonesite.comUnlock Your IT Potential