使用 pyshark 显示双 vlan答案

【问题标题】：Display double vlan using pyshark使用 pyshark 显示双 vlan
【发布时间】：2015-05-21 12:57:09
【问题描述】：

如果您有多个 vlan，例如，如果我有这个数据包，您如何获取 vlan 列表..

Layer ETH:
    Destination: 00:99:88:77:66:55 (00:99:88:77:66:55)
    .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Address: 00:99:88:77:66:55 (00:99:88:77:66:55)
    .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: 802.1Q Virtual LAN (0x8100)
    Source: 00:11:22:33:44:55 (00:11:22:33:44:55)
    .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Address: 00:11:22:33:44:55 (00:11:22:33:44:55)
    .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Layer VLAN:
    ...0 .... .... .... = CFI: Canonical (0)
    000. .... .... .... = Priority: Best Effort (default) (0)
    .... 0000 1100 1000 = ID: 200
    Type: 802.1Q Virtual LAN (0x8100)
Layer VLAN:
    Trailer: 8dbdde29
    ...0 .... .... .... = CFI: Canonical (0)
    000. .... .... .... = Priority: Best Effort (default) (0)
    .... 0000 0110 0100 = ID: 100
    Type: IP (0x0800)
Layer IP:
    ....
Layer UDP:
    ....

如果我使用 pyshark，我只会得到内部 vlan。

>>> print cap[0]['vlan']
Layer VLAN:
    ...0 .... .... .... = CFI: Canonical (0)
    000. .... .... .... = Priority: Best Effort (default) (0)
    .... 0000 1100 1000 = ID: 200
    Type: 802.1Q Virtual LAN (0x8100)

我希望它和 tshark 一样：

tshark -r filename.pcap -T fields -e vlan.id

100,200

【问题讨论】：

标签： python pcap tshark pyshark

【解决方案1】：

在 github 上管理此讨论：https://github.com/KimiNewt/pyshark/issues/80

获取双vlan的简单方法是：

vlan1, vlan2 = pkt[1], pkt[2]

或明确：

vlan1, vlan2 = pkt.layers[1], pkt.layers[2]

【讨论】：