Skip to content

Instantly share code, notes, and snippets.

@kylemanna
Last active March 23, 2019 01:36
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save kylemanna/0bc7e43a996f17d45935d7579cf3e89f to your computer and use it in GitHub Desktop.
Save kylemanna/0bc7e43a996f17d45935d7579cf3e89f to your computer and use it in GitHub Desktop.
#!/usr/bin/env python3
import timeit
import sys
from scapy.all import *
def read_pcap(fname, bpf, klass=PcapReader):
with klass(tcpdump(fname, args=["-w", "-", bpf], getfd=True)) as pcap_reader:
for pkt in pcap_reader:
#print(pkt.summary())
pass
if __name__ == '__main__':
fname = sys.argv[1] if len(sys.argv) > 1 else './test-1.pcap'
for t in [RawPcapReader, PcapReader]:
et=timeit.timeit('read_pcap("{}", "port 7503", {})'.format(fname, t.__name__), number=3, globals=globals())
print('{}: {}'.format(t, et))
~ ❯❯❯ ./print-test.py
reading from file ./test-1.pcap, link-type EN10MB (Ethernet)
reading from file ./test-1.pcap, link-type EN10MB (Ethernet)
reading from file ./test-1.pcap, link-type EN10MB (Ethernet)
<class 'scapy.utils.RawPcapReader'>: 3.0010140250087716
reading from file ./test-1.pcap, link-type EN10MB (Ethernet)
reading from file ./test-1.pcap, link-type EN10MB (Ethernet)
reading from file ./test-1.pcap, link-type EN10MB (Ethernet)
<class 'scapy.utils.PcapReader'>: 51.21891517401673
~ ❯❯❯ ls -lh ./test-1.pcap
-rw-r--r-- 1 km km 3.2G Mar 22 18:24 test-1.pcap
~ ❯❯❯ time tcpdump -r test-1.pcap > /dev/null
reading from file test-1.pcap, link-type EN10MB (Ethernet)
tcpdump -r test-1.pcap > /dev/null 1.63s user 0.92s system 99% cpu 2.569 total
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment