如何使用pyshark与Python打印数据包的信息、源IP、目的IP等详情

原代码仅能处理带传输层（TCP/UDP）和IP层的数据包，无法兼容ARP、ICMP、DNS等协议，会触发属性错误。以下是优化后的代码，可覆盖你需要的多种协议类型：

import pyshark
import time

capture = pyshark.LiveCapture(interface='eth0')
capture.sniff(timeout=5)
for packet in capture.sniff_continuously():
    localtime = time.asctime(time.localtime(time.time()))
    protocol = None
    src_addr = None
    dst_addr = None
    src_port = None
    dst_port = None
    info = packet.info if hasattr(packet, 'info') else '无额外信息'

    # 处理ARP协议
    if hasattr(packet, 'arp'):
        protocol = 'ARP'
        src_addr = packet.arp.src_proto_ipv4 if hasattr(packet.arp, 'src_proto_ipv4') else packet.arp.src_hw_mac
        dst_addr = packet.arp.dst_proto_ipv4 if hasattr(packet.arp, 'dst_proto_ipv4') else packet.arp.dst_hw_mac
    # 处理ICMP协议
    elif hasattr(packet, 'icmp'):
        protocol = 'ICMP'
        src_addr = packet.ip.src if hasattr(packet, 'ip') else '未知'
        dst_addr = packet.ip.dst if hasattr(packet, 'ip') else '未知'
    # 处理TCP/UDP传输层协议
    elif hasattr(packet, 'transport_layer'):
        protocol = packet.transport_layer
        src_addr = packet.ip.src if hasattr(packet, 'ip') else '未知'
        dst_addr = packet.ip.dst if hasattr(packet, 'ip') else '未知'
        src_port = packet[protocol].srcport if hasattr(packet[protocol], 'srcport') else '未知'
        dst_port = packet[protocol].dstport if hasattr(packet[protocol], 'dstport') else '未知'
    # 处理DNS协议（适配UDP/TCP承载的DNS包）
    elif hasattr(packet, 'dns'):
        protocol = 'DNS'
        src_addr = packet.ip.src if hasattr(packet, 'ip') else '未知'
        dst_addr = packet.ip.dst if hasattr(packet, 'ip') else '未知'
        src_port = packet.udp.srcport if hasattr(packet, 'udp') else packet.tcp.srcport if hasattr(packet, 'tcp') else '未知'
        dst_port = packet.udp.dstport if hasattr(packet, 'udp') else packet.tcp.dstport if hasattr(packet, 'tcp') else '未知'
    # 其他未匹配协议
    else:
        protocol = packet.highest_layer
        src_addr = '未知'
        dst_addr = '未知'

    # 格式化输出
    print(f"时间: {localtime}\t协议: {protocol}\t源地址: {src_addr}\t源端口: {src_port}\t目的地址: {dst_addr}\t信息: {info}")

代码说明： #

• 用hasattr()做属性存在性判断，避免因数据包缺少对应层触发报错
• 针对ARP、ICMP、DNS等特殊协议单独处理，适配其属性结构
• 对未匹配到的协议，用数据包最高层协议名称替代，并填充默认值
• 输出字段对应更清晰，可读性更强

内容的提问来源于stack exchange，提问作者user20828450