Package: pydivert
Python bindings forWinDivert, a Windows driver that allows user-mode applications to
capture/modify/drop network packets sent to/from the Windows network stack.RequirementsPython 2.7 or Python 3.4+ (32 or 64 bit)Windows Vista/7/8/10 or Windows Server 2008 (32 or 64 bit)Administrator PrivilegesInstallationYou can install PyDivert by running$ pip install pydivertStarting with PyDivert 1.0.2,WinDivertis bundled with
PyDivert and does not need to be installed separately.WinDivert Version CompatibilityPyDivertWinDivert0.0.71.0.x or 1.1.x1.0.x (API-compatible with 0.0.7)1.1.8 (bundled)2.0.x1.1.8 (bundled)2.1.x1.3 (bundled)Getting StartedPyDivert consists of two main classes:pydivert.WinDivertandpydivert.Packet.
First, you usually want to create aWinDivertobject to start capturing network traffic and then
call.recv()to receive the firstPacketthat was captured. By receiving packets, they are taken
out of the Windows network stack and will not be sent out unless you take action.
You can re-inject packets by calling.send(packet).
The following example opens a WinDivert handle, receives a single packet, prints it, re-injects it,
and then exits:importpydivert# Capture only TCP packets to port 80, i.e. HTTP requests.w=pydivert.WinDivert("tcp.DstPort == 80 and tcp.PayloadLength > 0")w.open()# packets will be captured from now onpacket=w.recv()# read a single packetprint(packet)w.send(packet)# re-inject the packet into the network stackw.close()# stop capturing packetsPackets that are not matched by the"tcp.DstPort == 80 and tcp.PayloadLength > 0"filter will not be handled by WinDivert
and continue as usual. The syntax for the filter language is described in theWinDivert documentation.Python Idiomspydivert.WinDivertinstances can be used ascontext managersfor capturing traffic and as (infinite)iteratorsover
packets. The following code is equivalent to the example above:importpydivertwithpydivert.WinDivert("tcp.DstPort == 80 and tcp.PayloadLength > 0")asw:forpacketinw:print(packet)w.send(packet)breakPacket Modificationpydivert.Packetprovides a variety of properties that can be used to access and modify the
packet’s headers or payload. For example, you can browse the web on port 1234 with PyDivert:importpydivertwithpydivert.WinDivert("tcp.DstPort == 1234 or tcp.SrcPort == 80")asw:forpacketinw:ifpacket.dst_port==1234:print(">")# packet to the serverpacket.dst_port=80ifpacket.src_port==80:print("<")# reply from the serverpacket.src_port=1234w.send(packet)Try openinghttp://example.com:1234/in your browser!WinDivert supports access and modification of a variety of TCP/UDP/ICMP attributes out of the box.>>>print(packet)Packet({'direction':<Direction.OUTBOUND:0>,'dst_addr':'93.184.216.34','dst_port':443,'icmpv4':None,'icmpv6':None,'interface':(23,0),'ipv4':{'src_addr':'192.168.86.169','dst_addr':'93.184.216.34','packet_len':81},'ipv6':None,'is_inbound':False,'is_loopback':False,'is_outbound':True,'payload':'\x17\x03\x03\x00$\x00\x00\x00\x00\x00\x00\x02\x05\x19q\xbd\xcfD\x8a\xe3...','raw':<memoryat0x028924E0>,'src_addr':'192.168.86.169','src_port':52387,'tcp':{'src_port':52387,'dst_port':443,'syn':False,'ack':True,'fin':False,'rst':False,'psh':True,'urg':False,'header_len':20,'payload':'\x17\x03\x03\x00$\x00\x00\x00\x00\x00\x00\x02\x05\x19q\xbd\xcfD\x8a\xe3...'},'udp':None})Uninstalling PyDivertYou can uninstall PyDivert by running$ pip uninstall pydivertIf the WinDivert driver is still running at that time, it will remove itself on the next reboot.API Reference DocumentationThe API Reference Documentation for PyDivert can be foundhere.