FileCapture Parameters

---

The FileCapture module within PyShark has several parameters that are configurable.

import pyshark

capture = pyshark.FileCapture(input_file=None, 
                              keep_packets=True, 
                              display_filter=None, 
                              only_summaries=False,
                              decryption_key=None, 
                              encryption_type="wpa-pwk", 
                              decode_as=None,
                              disable_protocol=None, 
                              tshark_path=None, 
                              override_prefs=None,
                              use_json=False, 
                              use_ek=False,
                              output_file=None, 
                              include_raw=False, 
                              eventloop=None, 
                              custom_parameters=None,
                              debug=False)
for packet in capture:
   # do something with the packet

• input_file:
  • type: string
  • default: None
  • description: File path of the capture (PCAP, PCAPNG)
• keep_packets:
  • type: boolean
  • default: True
  • description: Whether to keep packets after reading them via next(). Used to conserve memory when reading large caps (can only be used along with the "lazy" option!)
• display_filter:
  • type: string
  • default: None
  • description: Display (wireshark) filter to use.
• only_summaries:
  • type: boolean
  • default: False
  • description: Only produce packet summaries, much faster but includes very little information.
• decryption_key:
  • type: string
  • default: None
  • description: Optional key used to encrypt and decrypt captured traffic.
• encryption_type:
  • type: string
  • default: wpa-pwk
  • description: Standard of encryption used in captured traffic (must be either 'WEP', 'WPA-PWD', or 'WPA-PWK'.
• decode_as:
  • type: dictionary
  • default: None
  • description: A dictionary of {decode_criterion_string: decode_as_protocol} that are used to tell TShark to decode protocols in situations it wouldn't usually, for instance {'tcp.port==8888': 'http'} would make it attempt to decode any port 8888 traffic as HTTP. See TShark documentation for details.
• disable_protocol:
  • type: string
  • default: None
  • description: Tells tshark to remove a dissector for a specific protocol.
• tshark_path:
  • type: string
  • default: None
  • description: Path of the tshark binary.
• override_prefs:
  • type: dictionary
  • default: None
  • description: A dictionary of TShark preferences to override, {PREFERENCE_NAME: PREFERENCE_VALUE, ...}
• use_json:
  • type: boolean
  • default: False
  • description: DEPRECATED. Use use_ek instead.
• use_ek:
  • type: boolean
  • default: False
  • description: Uses TShark in EK JSON mode. It is faster than XML but has slightly less data
• output_file:
  • type: string
  • default: None
  • description: Save live captured packets to this file.
• include_raw:
  • type: boolean
  • default: False
  • description: Whether to include raw packet data.
• eventloop:
  • type: event loop object
  • default: None
  • description: Event loop to use for asynchronous operations.
• custom_parameters:
  • type: dictionary
  • default: None
  • description: A dict of custom parameters to pass to TShark, i.e. {"--param": "value"} or else a list of parameters in the format ["--foo", "bar", "--baz", "foo"]
• debug:
  • type: boolean
  • default: False
  • description: Whether to enable debug mode.