Pcapy and dpkt - tcpdump on steroids

on YouTube ↗04m

" summary

Uses Python plus pcapy and dpkt to move beyond raw tcpdump output by setting a libpcap filter, attaching a callback, and handing each packet to protocol parsers. Shows runnable code that listens on interface 0, filters UDP port 53, extracts DNS name and query type, and writes records to a database. Demonstrates producing top 7 DNS queries from captured traffic, notes that pcapy is libpcap-compatible, and that the approach reliably builds useful application‑layer aggregates.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 0:20What tools do we have today?
3. 2:11Examples of using pcapy
4. 2:58Example #2 - dns_to_db.py

" related talks

• 31mwww.yougottalovefrontend.comUri Shaked · You Gotta Love Frontend 2017
• 38mPacket Capture the FlagJason Rahm · F5 Agility 2021
• 30mPython and cffi Visualizing Network TracesAbhijit Gadgil · PyCon India 2020
• 39mAutomating BIG-IP Packet CapturesJason Rahm · F5 Agility 2021
• 05mHow to Analyse a DDoS QuacklyRemco Poortinga – van Wijnen · DuckCon #4
• 17mMonitoring DNS with Open-Source SolutionsFelipe Espinoza, Javier Bustos · SREcon18 Americas
• 24mDeep Network Traffic Observability with Pktvisor and PrometheusShannon Weyrick · PromCon North America 2021
• 46mCurio Collection of Web ProtocolsOle Michaelis · code.talks 2017