# Reading pcap files from Python wrapper?

**URL:** <https://community.zeek.org/t/reading-pcap-files-from-python-wrapper/5181>\
**Category:** Zeek\
**Created:** [February 12, 2018, 1:58pm UTC](https://community.zeek.org/t/reading-pcap-files-from-python-wrapper/5181 "2018-02-12T13:58:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rares\_Aioanei](https://avatars.discourse-cdn.com/v4/letter/r/e9a140/32.png) [@Rares\_Aioanei](https://community.zeek.org/u/Rares_Aioanei)\
**Post date:** [February 12, 2018, 1:58pm UTC](https://community.zeek.org/t/reading-pcap-files-from-python-wrapper/5181/1 "2018-02-12T13:58:03Z")

</div>

Hello,

I know that I can easily run bro from the CLI with a .pcap file and  
then analyze the logs it generates. However, what I need is to use the  
Bro API (preferrably Python) to \_open\_ the pcap file and generate the  
logs. Is this possible?

Thanks a lot in advance.

---

<div class="post-metadata">

**Author:** ![dopheide](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@dopheide](https://community.zeek.org/u/dopheide)\
**Post date:** [February 12, 2018, 4:37pm UTC](https://community.zeek.org/t/reading-pcap-files-from-python-wrapper/5181/2 "2018-02-12T16:37:05Z")

</div>

I’m not a core developer, but I can pretty much guarantee the API doesn’t support that. Reading pcaps is generally regarded as a testing mechanism, not part of a production architecture. For those folks where reading pcaps is a hard requirement, they usually end up building something around tcpreplay.

-Dop

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/reading-pcap-files-from-python-wrapper/5181/3 "2022-05-06T15:45:34Z")

</div>