pyshark无法访问有关数据包的数据

Question

我正在尝试使用 PyShark 将 .pcap 文件转换为 CSV 文件。我想打印我的 pcap 文件的第一个数据包的所有数据。

代码

import pyshark
cap = pyshark.FileCapture('test.pcap')
print(cap[0])

错误

ValueError: I/O operation on closed pipe

错误堆栈跟踪

    Fatal read error on pipe transport
protocol: <ReadSubprocessPipeProto fd=1 pipe=<_ProactorReadPipeTransport fd=572>>
transport: <_ProactorReadPipeTransport fd=572>
Traceback (most recent call last):
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 274, in _loop_reading
    self._read_fut = self._loop._proactor.recv(self._sock, 32768)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_events.py", line 416, in recv
    self._register_with_iocp(conn)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_events.py", line 641, in _register_with_iocp
    _overlapped.CreateIoCompletionPort(obj.fileno(), self._iocp, 0, 0)
OSError: [WinError 87] The parameter is incorrect
Exception in callback _ProactorReadPipeTransport._loop_reading(<_OverlappedF...t" size="1" '>)
handle: <Handle _ProactorReadPipeTransport._loop_reading(<_OverlappedF...t" size="1" '>)>
Traceback (most recent call last):
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 274, in _loop_reading
    self._read_fut = self._loop._proactor.recv(self._sock, 32768)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_events.py", line 416, in recv
    self._register_with_iocp(conn)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_events.py", line 641, in _register_with_iocp
    _overlapped.CreateIoCompletionPort(obj.fileno(), self._iocp, 0, 0)
OSError: [WinError 87] The parameter is incorrect

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\events.py", line 88, in _run
    self._context.run(self._callback, *self._args)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 284, in _loop_reading
    self._fatal_error(exc, 'Fatal read error on pipe transport')
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 110, in _fatal_error
    self._force_close(exc)
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 113, in _force_close
    if self._empty_waiter is not None:
AttributeError: '_ProactorReadPipeTransport' object has no attribute '_empty_waiter'
Exception ignored in: <function BaseSubprocessTransport.__del__ at 0x02F17588>
Traceback (most recent call last):
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\base_subprocess.py", line 125, in __del__
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\base_subprocess.py", line 78, in __repr__
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 57, in __repr__
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_utils.py", line 102, in fileno
ValueError: I/O operation on closed pipe
Exception ignored in: <function _ProactorBasePipeTransport.__del__ at 0x02F1F930>
Traceback (most recent call last):
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 93, in __del__
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\proactor_events.py", line 57, in __repr__
  File "C:\Users\barry\AppData\Local\Programs\Python\Python37-32\lib\asyncio\windows_utils.py", line 102, in fileno
ValueError: I/O operation on closed pipe

这是 WireShark 中的数据包。

以及伴随的Frame数据

非常感谢您解决此错误的任何帮助。

Answer 1

我遇到了同样的问题，通过调用close()函数解决了。

import pyshark
cap = pyshark.FileCapture('test.pcap')
print(cap[0])
cap.close()

Answer 2

我查看了文档：https://kiminewt.github.io/pyshark/，您使用它时看起来很简单。

还看了open issues，没找到相关的。

我建议尝试不同的捕获（可能是.cap），如果您遇到相同的错误。

我会说它与以下错误有关：https://bugs.python.org/msg374758。

你可以试试mptcpanalyzer作为替代

# the script will try to generate a csv file
$ mptcpanalyzer --load test.pcap