0

我正在尝试使用 Pyshark 解析 PCAP 文件。一些数据包中包含 JSON，我正在尝试使用匹配的键：值将它们打印出来。

这是我目前的测试：

import pyshark

packets = pyshark.FileCapture('cap.pcapng')
pack = packets[1] #get the packet that has JSON

print(pack.json.get_field_value('app')

这样做时，我会被None打印出来。

如果我打印整个 JSON 层，我会得到如下数据：

    Object
    Member Key: anonymousId
    String value: f268204c-5719-43ce-9a5e-094d8f3df6b8
    Key: anonymousId
    True value
    Object
    Object
    Object
    Object
    Object
    Object
    Member Key: context
    Member Key: app
    Member Key: app_name
    Member Key: app_platform
    Member Key: app_version
    Member Key: device
    Member Key: adTrackingEnabled
    Member Key: advertisingId
    Member Key: id
    Member Key: manufacturer
    Member Key: model
    Member Key: resolution
    Member Key: type
    Member Key: version
    Member Key: ip
    Member Key: library
    Member Key: name
    Member Key: version
    Member Key: locale
    Member Key: os
    Member Key: name
    Member Key: version
    Member Key: primary_business_unit
    Member Key: secondary_business_unit
    Member Key: traits
    Member Key: entitlements
    Member Key: mvpd
    Member Key: userAgent
    Member Key: event
    Member Key: properties
    Member Key: type
    Member Key: userId
    String value: Fox Now
    String value: foxnow
    String value: roku
    String value: 3.18.0
    String value: 622ac229-c26e-5318-89bd-b281da9bed32
    String value: 1de01830-d4bb-5d12-9d86-f81da8d12698
    String value: Roku
    String value: 3600X
    String value: 1080p
    String value: roku
    String value: 249.10E04111A
    String value: 71.120.154.30
    String value: SegmentAnalyticsService.brs
    String value: 3.18.0 (11624)
    String value: en-US
    String value: Roku
    String value: 9.10 build 4111
    String value: fng
    String value: fox
    String value: btn-btn2go,fbc-fox,FoxBusiness,foxdep,FoxNews,fs1,fs2,fx,fxm,fxx,ngc,ngw
    String value: verizon
    String value: Roku/DVP-9.10 (249.10E04111A)
    String value: Live TV Section Viewed
    String value: track
    String value: MTM0OTA5MDktNWE1MC00YTg4LWJhNWItYzdmMDA1N2UyYjQz
    Key: app
    Key: app_name
    Key: app_platform
    Key: app_version
    Key: adTrackingEnabled
    Key: advertisingId
    Key: id
    Key: manufacturer
    Key: model
    Key: resolution
    Key: type
    Key: version
    Key: device
    Key: ip
    Key: name
    Key: version
    Key: library
    Key: locale
    Key: name
    Key: version
    Key: os
    Key: primary_business_unit
    Key: secondary_business_unit
    Key: entitlements
    Key: mvpd
    Key: traits
    Key: userAgent
    Key: context
    Key: event
    Key: properties
    Key: type
    Key: userId

这就是 JSON 的样子..

在此处输入图像描述

我希望能够遍历 JSON 中的每个值并打印它所包含的值和键。

所以我想基本上打印 JSON 输出与它匹配的样子。

我试过谷歌搜索，但找不到任何对我有用的例子。

4

1 回答 1

1

尝试通过 Filecapture 方法打开 PCAP 文件时，设置“use_json=True”。这将以类似 JSON 的格式捕获数据包。

import pyshark

packets = pyshark.FileCapture('cap.pcapng',use_json=True,include_raw=True)
pack = packets[1] #get the packet that has JSON

jsonStr=str(pack.json)
print(jsonStr)

这将以以下方式打印数据包的 JSON 层：

Layer JSON:
   object_raw: 7ba298
   object_raw: 234
   object_raw: 97
   object:
      member_raw: 345ad
      member_raw: 4567
      
      member:
         key: manufacturer
         string: Live TV Section Viewed
         value.string: abcd
         value.string_raw: ab345
         key_raw: 8abc6
         string_raw: 67ac
      member:
         key: ip
         string: 71.120.154.30
         value.string: 234
         value.string_raw: ab345
         key_raw: 8abc6
         string_raw: 67ac

因此，此字符串 (jsonStr) 中的每个“成员”段都包含一个“键”字段和一个“字符串”字段，它们对应于您在原始 JSON 中的键值对以及其他原始数据。您可以在使用 FileCapture 方法捕获数据包时使用 'include_raw=False' 省略原始数据。通过使用键（例如“制造商”）和值的数据类型（字符串或数字），您可以提取所需的任何键的值。

于 2020-08-07T11:08:09.237 回答