Reading pcap files with scapy

In this section, you will learn the basics for reading pcap files. PCAP (Packet CAPture) refers to the API that allows you to capture network packets for processing. The PCAP format is a standard and is used by practically all network-analysis tools, such as TCPDump, WinDump, Wireshark, TShark, and Ettercap.

Introduction to the PCAP format

By analogy, the information captured using this technique is stored in a file with the .pcap extension. This file contains frames and network packets and is very useful if we need to save the result of a network analysis for later processing.

These files are very useful if we need to save the result of a network analysis for later processing or as evidence of...