Member-only story
Capturing Network Traffic With Python And TShark
Have you ever wanted to add packet analysis to an existing program? Ever needed to take a packet capture and make the output just a little more readable? Working with standard tools like Wireshark or tcpdump can be pretty convoluted.
Trying to jam a bunch of tcpdump parameters together is cumbersome at best. Working with Wireshark on the command-line is also virtually impossible. That’s why TShark was created. TShark provides an easy command-line interface for Wireshark. It’s less confusing than the longstanding tcpdump and packed with way more features.
The best part is, there is a Python wrapper for TShark called Pyshark. This wrapper provides a clean interface from Python to the underlying TShark application.
Let’s take a look at how we can capture traffic using Pyshark and bring the wonderful world of network analysis to our apps.
Prerequisites
In order to get started with Pyshark you’ll need to already have TShark installed. You can install TShark using your favorite package manager:
# macOS (tshark included with Wireshark in Brew)
brew install --cask wireshark# Debian
sudo apt install tshark
