0

我正在尝试从linux终端中运行dumpcap的输出中解析文件名，以便自动将其附加到电子邮件中。这是来自较大脚本的相关功能。proc1, stdout, andeventfile被初始化为""andDUMPCAP是命令行字符串 dumpcap -a duration:300 -b duration:2147483647 -c 500 -i 1 -n -p -s 2 -w test -B 20

def startdump():                       
    global DUMPCAP                     
    global dumpdirectory               
    global proc1                       
    global stdout                      
    global eventfile                   
    setDumpcapOptions()                
    print("dumpcap.exe = " + DUMPCAP)  
    os.chdir(dumpdirectory)            
    #subprocess.CREATE_NEW_CONSOLE     
    proc1 = subprocess.Popen(DUMPCAP, shell=True, stdout=subprocess.PIPE)
    for line in proc1:                 
        if 'File: ' in line:           
            parsedfile = line.split(':')
            eventfile = parsedfile[1]  
    if dc_mode == "Dumpcap Only":      
        proc1.communicate()            
        mail_man(config_file)          
     return proc1                       

def startevent():
    global EVENT
    global proc1
    global eventfile
    setEventOptions()
    print(EVENT)
    # subprocess.CREATE_NEW_CONSOLE
    proc2 = subprocess.Popen(EVENT, shell=True, stdout=subprocess.PIPE) 
    if dc_mode == "Dumpcap+Event" or dc_mode == "Trigger" or dc_mode == "Event Only":
        proc2 = proc1.communicate()
        mail_man(config_file)
    return proc2

我一直遇到的问题是我无法弄清楚如何从dumpcap. ""无论我做什么，它都会不断地从输出中解析。如果这似乎未经研究，我深表歉意。我花了一个月的时间自己学习 python 和 linux，并且在线文档很简洁且令人困惑。

我应该创建一个函数来从 dumpcap 的输出中解析 eventfile 还是直接在脚本中执行它？我在这里真的很茫然。我也不确定 dumpcap 如何存储它的输出。

终端中dumcap的输出为：

dumpcap.exe = dumpcap -a duration:300 -b duration:2147483647 -c 500 -i 1 -n -p -s 2 -w test -B 20
 -i 1 - f icmp and host 156.24.31.29 - c 2
/bin/sh: -i: command not found
Capturing on 'eth0'
File: test_00001_20150714141827
Packets captured: 500
Packets received/dropped on interface 'eth0': 500/0 (pcap:0/dumpcap:0/flushed:0/ps_ifdrop:0) (100.0%)
[Errno 2] No such file or directory: ''

该行包含我正在尝试从终端解析该行以获取设置为变量之后的所有内容，但保存File: ...的文件的随机生成名称。方法似乎不起作用pcapdumpcapFile:split

它给出的另一个错误是Popen无法索引

4

2 回答 2

0

看起来基本上你需要一个正则表达式。

import re
rx = re.compile('^File: (\S+)$', re.MULTILINE)
m = rx.search(stdout_contents)
if m:
  file_name = m.group(1)
# else: file name not detected.

更新：读取管道标准输出的最小完整示例；希望这可以帮助。

import subprocess
proc = subprocess.Popen("echo foo", shell=True, stdout=subprocess.PIPE)
result = proc.communicate()
print result[0]  # must be `foo\n`
于 2015-07-14T19:46:13.053 回答
0

Dumpcap 输出到它的标准错误，而不是标准输出。所以我设法将stderr重定向到一个txt文件，然后我可以解析它。

def startdump():
    global DUMPCAP, dumpdirectory, proc1
    global eventfile, dc_capfile

    DUMPCAP = ''
    print("========================[ MAIN DUMPCAP MONITORING ]===========================")
    setDumpcapOptions()
    os.chdir(dumpdirectory)
    if platform == "Linux":
        DUMPCAP = "dumpcap " + DUMPCAP
    elif platform == "Windows":
        DUMPCAP = "dumpcap.exe " + DUMPCAP
    proc1 = subprocess.Popen(DUMPCAP, shell=True, stderr=subprocess.PIPE)
    #procPID = proc1.pid
    if dc_mode == "Dumpcap Only":
        time.sleep(5)
        with open("proc1stderr.txt", 'w+') as proc1stderr:
            proc1stderr.write(str(proc1.stderr))
            for line in proc1.stderr:
                print("%s" % line)
                if "File:" in line:
                    print(line)
                    raweventfile = line.split('File: ')[1]
                    eventfile = raweventfile.strip('\[]').rstrip('\n')
                    mail_man()
            proc1.communicate()
于 2015-07-30T14:08:58.433 回答