pyshark icon indicating copy to clipboard operation
pyshark copied to clipboard

Access packet "Options"?

Open tranzmatt opened this issue 2 years ago • 0 comments

Is there a way to access the options field in a pcapng packet? I'm trying to use pyshark to parse through pcapng files converted from Kismet, which inserts its GPS coordinates into the packet as per their documentation

If I open the pcapng file directly with a hex editor like bless, I can see the bytes I want

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Custom Option Code (2989) |         Option Length         |
+---------------------------------------------------------------+
|                Private Enterprise Number (55922)              |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| GPS Magic(0x47)| Version      |            Length             |
+---------------------------------------------------------------+

But I don't see any way to get to it via pyshark. Is there some mechanism I can't see or do I need to somehow customize/extend pyshark?

tranzmatt avatar Nov 01 '22 01:11 tranzmatt