使用pyshark从SMTP包中获取"To“和" from”字段

pip install pyshark

import pyshark

cap = pyshark.FileCapture('smtp.pcap')  # 打开捕获的SMTP包文件
# 或者
cap = pyshark.LiveCapture(interface='eth0', bpf_filter='tcp port 25')  # 实时抓包

for pkt in cap:
    if 'smtp' in pkt:  # 确保是SMTP协议的包
        to_field = pkt['smtp.to']  # 获取"To"字段
        from_field = pkt['smtp.from']  # 获取"From"字段
        print("To: ", to_field)
        print("From: ", from_field)