5

In this code with pyshark

import pyshark
cap = pyshark.FileCapture(filename)
i = 0
for idx, packet in enumerate(cap):
    i += 1
print i
print len(cap._packets)

i and len(cap._packets) give two different results. Why is that?

Dhia
  • 10,119
  • 11
  • 58
  • 69
Bob
  • 10,741
  • 27
  • 89
  • 143

4 Answers4

11

Don't know if it works in Python 2.7, but in Python 3.4 len(cap) returns 0. The FileCapture object is a generator, so what worked for me is len([packet for packet in cap])

Derorrist
  • 2,753
  • 1
  • 17
  • 26
  • Why i get ` raise RuntimeError('This event loop is already running') RuntimeError: This event loop is already running` when running `len([packet for packet in cap])`? – user3806649 Feb 26 '20 at 22:08
7

i too, len(cap) is 0, i thinks the answer is fail. if you want know len(cap), please load packet before print it. use: cap.load_packets()

cap.load_packets()
packet_amount = len(cap)
print packet_amount
langiac
  • 317
  • 1
  • 3
  • 16
0

A look at the source code reveals that _packets is a list containing packets and is only used internally:

When iterating through a FileCapture object with keep_packets = True packets are getting added to this list.

To get access to all packets in a FileCapture object you should iterate over it just like you did:

for packet in cap:
    do_something(packet)

But to count the amount of packets just do this:

packet_amount = len(cap)

or use a counter like you did, but don't use _packets as it does not contain the complete packet list.

Leistungsabfall
  • 6,368
  • 7
  • 33
  • 41
0

Just adding another way using callback function. Also little bit faster approach.

length = 0 
def count_callback(pkt):
    global length
    length = length + 1

cap.apply_on_packets(count_callback)

print(length)
Prateek Kumar Singh
  • 121
  • 2
  • 6