Is it possible to apply display filter after reading the captured file in pyshark?

  pyshark, python

Need to apply display filter after loading the captured file to perform further analysis on packets.
Tried closing and reopening the captured packet but it takes lot of time as captured file size is in GB.

This is what I tried:

import pyshark

# Opened captured file with display filter
cap = pyshark.FileCapture("test.pcap", display_filter = "ip.addr eq 192.168.1.1")

# Do Something here

#Close the captured file
cap.close()

#Repoens the file with extra display filter on top the above one
cap = pyshark.FileCapture("test.pcap", display_filter = "ip.addr eq 192.168.1.1 and tcp.analysis.flags")

#Do Something here

#close the file
cap.close()

Is it possible to apply display filter on top of the previous filter to avoid multiple loading of same file as in the above case?

Source: Python Questions

LEAVE A COMMENT