pypcap example

spy.py

# coding:utf-8
import pcap
import dpkt
from datetime import datetime

pc = pcap.pcap()
pc.setfilter('tcp port 80')
for ptime, pdata in pc:
    print datetime.fromtimestamp(ptime).strftime('%Y-%m-%d %H:%M:%S')#, pdata
    p = dpkt.ethernet.Ethernet(pdata)
    if p.data.__class__.__name__ == 'IP':
        ip = '%d.%d.%d.%d' % tuple(map(ord, list(p.data.dst)))
        print 'ip:', ip
        if p.data.data.__class__.__name__ == 'TCP':
            if p.data.data.dport == 80:
                print '==data==\n', p.data.data.data