Need to apply display filter after loading the captured file to perform further analysis on packets.
Tried closing and reopening the captured packet but it takes lot of time as captured file size is in GB.
This is what I tried:
import pyshark # Opened captured file with display filter cap = pyshark.FileCapture("test.pcap", display_filter = "ip.addr eq 192.168.1.1") # Do Something here #Close the captured file cap.close() #Repoens the file with extra display filter on top the above one cap = pyshark.FileCapture("test.pcap", display_filter = "ip.addr eq 192.168.1.1 and tcp.analysis.flags") #Do Something here #close the file cap.close()
Is it possible to apply display filter on top of the previous filter to avoid multiple loading of same file as in the above case?
Source: Python Questions