0

我正在尝试使用 PyShark 将 .pcap 文件转换为 CSV 文件。我想打印关于我的 pcap 文件的第一个数据包的所有数据。

代码

import pyshark
cap = pyshark.FileCapture('test.pcap')
print(cap[0])

错误

ValueError: I/O operation on closed pipe

错误堆栈跟踪

    Fatal read error on pipe transport
protocol: <ReadSubprocessPipeProto fd=1 pipe=<_ProactorReadPipeTransport fd=572>>
transport: <_ProactorReadPipeTransport fd=572>
Traceback (most recent call last):
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 274, in _loop_reading
    self._read_fut = self._loop._proactor.recv(self._sock, 32768)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_events.py", line 416, in recv
    self._register_with_iocp(conn)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_events.py", line 641, in _register_with_iocp
    _overlapped.CreateIoCompletionPort(obj.fileno(), self._iocp, 0, 0)
OSError: [WinError 87] The parameter is incorrect
Exception in callback _ProactorReadPipeTransport._loop_reading(<_OverlappedF...t" size="1" '>)
handle: <Handle _ProactorReadPipeTransport._loop_reading(<_OverlappedF...t" size="1" '>)>
Traceback (most recent call last):
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 274, in _loop_reading
    self._read_fut = self._loop._proactor.recv(self._sock, 32768)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_events.py", line 416, in recv
    self._register_with_iocp(conn)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_events.py", line 641, in _register_with_iocp
    _overlapped.CreateIoCompletionPort(obj.fileno(), self._iocp, 0, 0)
OSError: [WinError 87] The parameter is incorrect

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\events.py", line 88, in _run
    self._context.run(self._callback, *self._args)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 284, in _loop_reading
    self._fatal_error(exc, 'Fatal read error on pipe transport')
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 110, in _fatal_error
    self._force_close(exc)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 113, in _force_close
    if self._empty_waiter is not None:
AttributeError: '_ProactorReadPipeTransport' object has no attribute '_empty_waiter'
Exception ignored in: <function BaseSubprocessTransport.__del__ at 0x02F17588>
Traceback (most recent call last):
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\base_subprocess.py", line 125, in __del__
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\base_subprocess.py", line 78, in __repr__
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 57, in __repr__
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_utils.py", line 102, in fileno
ValueError: I/O operation on closed pipe
Exception ignored in: <function _ProactorBasePipeTransport.__del__ at 0x02F1F930>
Traceback (most recent call last):
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 93, in __del__
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 57, in __repr__
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_utils.py", line 102, in fileno
ValueError: I/O operation on closed pipe

这是 WireShark 中的数据包。

包

以及随附的 Frame 数据

数据包信息

非常感谢解决此错误的任何帮助。

4

2 回答 2

0

我遇到了同样的问题，通过调用close()函数解决了。

import pyshark
cap = pyshark.FileCapture('test.pcap')
print(cap[0])
cap.close()
于 2021-12-22T02:31:33.257 回答
0

我查看了文档：https ://kiminewt.github.io/pyshark/ ，当你使用它时它看起来很简单。

还查看了未解决的问题，但没有发现任何相关内容。

我建议尝试使用不同的捕获（可能是 a .cap），如果您有相同的错误。

我会说它与以下错误有关：https ://bugs.python.org/msg374758 。

您可以尝试mptcpanalyzer作为替代方案

# the script will try to generate a csv file
$ mptcpanalyzer --load test.pcap
于 2020-08-31T12:58:52.513 回答