import dpkt,sys import re import itertools fd = open(sys.argv[1]) pcap = dpkt.pcap.Reader(fd) trg = '\xcax\x07\xd3' data = '' urps = [] idx = 0 for ts, buf in pcap: eth = dpkt.ethernet.Ethernet(buf) ip = eth.data tcp = ip.data if ip.src != trg: continue if tcp.flags & dpkt.tcp.TH_URG: print idx,tcp.urp,len(tcp.data) data += tcp.data idx+=1 with open('/tmp/orig.txt') as f: d = f.read() orig = d.split() new = data.split() f= lambda idx: filter(lambda x: x[0] != x[1],zip(new[idx],itertools.cycle(orig[idx])))[0][0] diffs = filter(lambda x: not x[1],enumerate(map(lambda x: x[0]==x[1],zip(new,orig))))[:24] print ''.join(map(lambda i:f(i),map(lambda x:x[0],diffs)))