libpcap、struct、dpkt、scapy、pyshark五种方式获取pcap原始包的速度对比

本文对比了五种不同PCAP解析库的性能:libpcap、原始二进制读取、dpkt、scapy和pyshark。通过重复实验得出各库的平均处理时间,并据此评估它们的速度和易用性。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

from pylibpcap.pcap import rpcap
import struct
from dpkt.pcap import Reader
from scapy.all import rdpcap
#from scapy.all import PcapReader
import pyshark
from timeit import repeat
import time

fileName = "/Users/microfat/Downloads/new/N1N2.pcap"
def libpcap_test():
    for _, _, packet in rpcap(fileName):
        pass

def orig_test():
    string_data = None
    with open(fileName, 'rb') as fpcap:
        string_data = fpcap.read()

    packet_num = 0
    packet_data = []
    i =24

    while(i<len(string_data)):
        packet_len = struct.unpack('I',string_data[i+12:i+16])[0]
        packet_data.append(string_data[i+16:i+16+packet_len])
        i = i+ packet_len+16
        packet_num+=1
    for packet in packet_data:
        pass

def dpkt_test():
    with open(fileName, 'rb') as f:
        for _, packet in Reader(f):
            pass

def scapy_test():
    for packet in rdpcap(fileName):
        pass

def pyshark_test():
    cap = pyshark.FileCapture(fileName, use_json=True, include_raw=True)
    for packet in cap:
        packet.get_raw_packet()

if __name__ == "__main__":
    libpcap_test_time = repeat(stmt=libpcap_test, repeat=100, number=1)
    time.sleep(1)
    orig_test_time    = repeat(stmt=orig_test, repeat=100, number=1)
    time.sleep(1)
    dpkt_test_time    = repeat(stmt=dpkt_test, repeat=100, number=1)
    time.sleep(1)
    scapy_test_time   = repeat(stmt=scapy_test, repeat=100, number=1)
    time.sleep(1)
    pyshark_test_time = repeat(stmt=pyshark_test, repeat=100, number=1)

    print('libpcap:', sum(libpcap_test_time)/len(libpcap_test_time))
    print('orig:   ', sum(orig_test_time)/len(orig_test_time))
    print('dpkt:   ', sum(dpkt_test_time)/len(dpkt_test_time))
    print('scapy:  ', sum(scapy_test_time)/len(scapy_test_time))
    print('pyshark:', sum(pyshark_test_time)/len(pyshark_test_time))
libpcap: 0.00011515187999975751
orig:    0.0005123037399994246
dpkt:    0.0010648190799918212
scapy:   0.05218072557000596
pyshark: 0.7941113060799978

结论:
libpcap > struct > dpkt > scapy > pyshark

pylibpcap由于使用到了Cython libpcap,因而速度非常快

但在功能易用性上来说大致是相反的结论

参考:https://stackoverflow.com/a/56119892

评论 1
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值