Home/ Questions/Q 8252509
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-08T00:34:56+00:00

I am attempting to work with large packet captures from wireshark that have been

  • 0

I am attempting to work with large packet captures from wireshark that have been output in pdml format. These captures are then loaded into python using the lxml library to traverse over them. The issue I am having is that I can pull out information regarding a single HTTP response packet and then I need a way to associate this with its HTTP request packet.

The current solution I was thinking of implementing is to search for an HTTP request packet that is part of the same TCP stream as the response, however this seems like an inefficient solution to the problem, having to continually separate out TCP streams and then search through them for the request packet.

Is there a simple way to associate response packets with requests that I am missing?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Best solution I have come up with thus far is to use xpath under the assumption that each TCP connection only contains one request/response pair.

    #Get the stream index from the packet
streamIndex = packet.xpath('proto/field[@name="tcp.stream"]')[0].attrib['show']
#Use that stream index to get the matching response packet
return packet.xpath('/pdml/packet[proto/field[@name="tcp.stream" and @show="' + streamIndex + '"] and proto/field[@name="http.request.full_uri"]]')[0]
    • 0