#coding=utf-8
import string
import urllib
import json
from scapy.all import *
import re
readfile =input("请输入需要分析的文件名：")
mail_port=input("请输入您要解析的邮件类型（IMAP输入143，SMTP输入25，POP3输入110）:")
savefile=input("请输入您要保存的文件名：")

dpkt1=list()
dpkt2=list()
dpkt = rdpcap(readfile)
print(dpkt)
sessions = dpkt.sessions()
print(sessions)
for session in sessions:
payload = b''  # the payload of one HTTP POST
for packet in sessions[session]:
try:
#if  packet['TCP'].dport ==int(mail_port):

对数据组包

        dpkt2.append(str(packet[TCP].window))
        print(dpkt2)
 except:
    pass

string=''.join(dpkt2)
#string=str(dpkt2)
string=string.replace("\r\n","")
string=string.replace("\t","")
string=string.replace("'b'","")
string=string.replace(" ","")
dlist=list()
dNumb=0
i=1
a=len(dpkt2)
print(string)

From = ''.join(re.findall(u"From:(.com>)", string))
To=''.join(re.findall(u"To:(,?.?com?>)",string))
Cc=''.join(re.findall(u"Cc:(,?.?com>)",string))
Bcc=''.join(re.findall(u"Bcc:(,?.?com>)",string))
Subject=''.join(re.findall(u"Subject:([A-Za-z0-9]+)X-Priority",string))
Content = ''.join(re.findall(u"base64([A-Za-z0-9=/+]+?)---", string))
AttachName = ''.join(re.findall(u"filename=(\".?\")", string))
Attach = ''.join(re.findall(u"filename=\".?\"([A-Za-z0-9=/+]+?)---", string))
dict={"From":From,"To":To,"Cc":Cc,"Bcc":Bcc,"Subject":Subject,"Content":base64.b64decode(Content),"AttachName":AttachName,"Attach":Attach}
dlist.append(dict)
dNumb=dNumb+1

f = open(savefile,"w+")
for i in range(dNumb):  #原来是dnmb
#f.write(to)
#f.write(str(dlist[i])+"\r\n")
#print(dlist[i])
for key,value in dlist[i].items():
print('{key}:{value}'.format(key = key, value = value))
f.write(str('{key}:{value}'.format(key = key, value = value))+"\r\n")