Python and cffi Visualizing Network Traces
summary
Python bindings for Wireshark and libpcap are implemented with cffi, using cffi set_source/verify to generate a compiled extension and cffi_modules for setup.py integration. The project exposes higher-level capturer and detector classes that hide C APIs, dumps decoded JSON to Elasticsearch, and handles multiple libwireshark versions by splitting src and lib code. Performance tests show the Python+ cffi pipeline is roughly 4–5× faster than calling tshark in a subprocess and is reliable for large pcaps.
AI-written summary · about
chapters (15)
- 0:00Start
- 5:38What Is Cffi
- 7:48Application Programming Interface
- 8:42Three Stages of Development
- 9:16Development Stage
- 9:34What Ac Library Is
- 14:09Package Config Library
- 17:06Cff Modules
- 18:16Runtime Stage
- 20:19Capturer and Detector
- 21:53Summary
- 23:20Garbage Collection
- 25:42Use Python Functions as Callbacks
- 28:08Demo
- 29:32Conclusion
related talks
04mPcapy and dpkt - tcpdump on steroids
22mPython for bridging between researchers and service operators: from CFFI to Jupyterhub
36mPython, C, C++, and Fortran Relationship Status: It’s Not That Complicated
28mCall a C API from Python becomes more enjoyable with CFFI
01h 02mWriting Python Bindings for C++ Libraries: Easy-to-use Performance
40mPython for NET or NET for Python
23mPython for Threat Intelligence
32mProfiling at the speed of light