Parsing large tcpdump files in python

Question

I have a large tcpdump capture ( with > 1gb of data in a .dump file) which I would like to parse to get some statistics like the number of different IPs involved in sending traffic, etc. I would like to know if there is a clean way of accessing such data in the binary trace file through python? The way I tried doing it is by running tcpdump -r something.dump > myfile.out And then try to parse myfile.out with python code to get the data i want. But the command above is taking forever to complete and would like to use a better way of doing this.

Edit: Wireshark runs out of memory while trying to open the file.

Solution

Take a look at the dpkt module. It should be able to parse the pcap file on demand. Jon Oberheide has a great blog post showing how you can access the parsed representation of packets within a pcap packet capture file.