使用python来统计网卡数据流量

先使用工具tcpdump或是wireshark抓取pcap文件保存下来，再使用python来分析

from scapy.all import rdpcap, IP, TCP, UDP
from collections import defaultdict
import argparse
import sys
#按目的IP地址统计流量
def analyze_pcap_by_dst_ip(pcap_file, verbose=False):
    """
    按目的IP统计PCAP文件流量
    :param pcap_file: PCAP文件路径
    :param verbose: 是否显示解析进度
    :return: (总流量字典, 协议流量字典)
    """
    dst_traffic = defaultdict(int)          # 目的IP总流量 {ip: bytes}
    proto_traffic = defaultdict(int)         # 按协议统计流量 {协议: bytes}
    
    try:
        packets = rdpcap(pcap_file)          # 读取PCAP文件
        total_packets = len(packets)
        
        for i, packet in enumerate(packets):
            if verbose and i % 1000 == 0:    # 每1000个包显示进度
                print(f"解析进度: {i}/{total_packets} 数据包...")
                
            if IP in packet:
                dst_ip = packet[IP].dst
                packet_size = len(packet)     # 获取数据包字节数
                
                # 统计目的IP流量
                dst_traffic[dst_ip] += packet_size
                
                # 按协议统计 (TCP/UDP/其他)
                if TCP in packet:
                    proto_traffic["TCP"] += packet_size
                elif UDP in packet:
                    proto_traffic["UDP"] += packet_size
                else:
                    proto_traffic["Other"] += packet_size
                    
    except Exception as e:
        print(f"解析失败: {str(e)}", file=sys.stderr)
        sys.exit(1)
        
    return dst_traffic, proto_traffic

def export_results(dst_traffic, proto_traffic, output_file=None):
    """
    输出统计结果（控制台或文件）
    :param dst_traffic: 目的IP流量字典
    :param proto_traffic: 协议流量字典
    :param output_file: 输出文件路径（可选）
    """
    # 按流量从大到小排序
    sorted_traffic = sorted(dst_traffic.items(), key=lambda x: x[1], reverse=True)
    
    result = []
    result.append("============ 目的IP流量统计 ============")
    result.append(f"{'目的IP':<20} {'流量(bytes)':>15}")
    result.append("-" * 40)
    for ip, traffic in sorted_traffic:
        result.append(f"{ip:<20} {traffic:>15}")
    
    result.append("\n============== 协议流量统计 =============")
    for proto, traffic in proto_traffic.items():
        result.append(f"{proto + ':':<10} {traffic:>15} bytes")
    
    # 输出到控制台或文件
    output = "\n".join(result)
    if output_file:
        with open(output_file, 'w') as f:
            f.write(output)
        print(f"结果已导出至: {output_file}")
    else:
        print(output)

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="PCAP流量分析 - 按目的IP统计")
    parser.add_argument("pcap_file", help="PCAP文件路径")
    parser.add_argument("--output", "-o", help="结果输出文件（可选）")
    parser.add_argument("--verbose", "-v", action="store_true", help="显示详细解析进度")
    args = parser.parse_args()
    
    dst_traffic, proto_traffic = analyze_pcap_by_dst_ip(args.pcap_file, args.verbose)
    export_results(dst_traffic, proto_traffic, args.output)

运行结果