PCAPNG Writer

This modules contains a surprisingly complete implementation of the PCAPNG file format for use with the Squishy SCSI Analyzer applet to generate traffic captures.

This also is part of the “living” standardization/documentation for the LINKTYPE_PARALLEL_SCSI found at https://github.com/squishy-scsi/wireshark-scsi/docs/LINKTYPE_PARALLEL_SCSI.md

class squishy.core.pcapng.PCAPNGStream(file: str | Path | BinaryIO | bytes | bytearray, /)

A PCAPNG stream-based emitter

Some example usage is as follows:

with PCAPNGStream('/tmp/garbage.pcapng') as stream:
        stream.emit_header(hardware = 'trash-can')
        iface = stream.emit_interface(LinkType.USER00, 'trash')
        for _ in range(128):
                iface.emit_packet(randbytes(randint(128, 4096)))

emit_header(*, hardware: str, writer: str | None = None, os: str | None = None, options: Iterable = ())

Emit a Section Header Block.

This should be done at the very start of the PCAPNG stream.

Parameters:

hardware (str | None) – The hardware being used to do the capture.

optionsIterable

Any extra options to attach to the block. (default: [])

emit_interface(type: LinkType, name: str, *, options: Iterable = ()) → _PCAPNGInterface

Create a new Interface Description Block and obtain a proxy object to use to add packets to the PCAPNG Stream.

Parameters:

• type (LinkType) – The link-layer type of this interface.

• name (str) – The name of this interface.

• options (Iterable) – Any extra options to attach to the block. (default: [])

Returns:

A PCAPNGStream proxy object for interacting with the newly added interface

Return type:

_PCAPNGInterface