不知道是否有更好的解决方案，但这是我为解决问题所做的工作。累积的帧大小似乎与Wireshark从多个数据包重组TLS帧时的行为一致。
注意
：此解决方案假定没有错误排序的数据包或重复。此外，此处显示的解决方案也不完整。以下代码仅显示当TLS帧跨越单个TCP流的多个IP数据包时如何累积TLS帧。请遵循Janus的建议（在下面的评论中提到），或提出自己的解决方案以累积不同的流。
def extractDataFromPcap(pcapfile): load_layer("tls") try: reader = PcapReader(pcapfile) # tls frame accumulation related variables. tls_accumulate = False tls_leftover_len = 0 tls_blist = list() for pkt in reader: try: if tls_accumulate and pkt.haslayer(TCP): ip_tcp_hdr_overhead = ((pkt[IP].ihl*4) + (pkt[TCP].dataofs*4)) pkt_payload_len = (pkt[IP].len - ip_tcp_hdr_overhead) tls_leftover_len = (tls_leftover_len - pkt_payload_len) tls_blist.append(raw(pkt[TCP].payload)) if tls_leftover_len <= 0: # got complete TLS frame tls_raw_bytes = b''.join(tls_blist) # parse accumulated frame. tls = TLS(tls_raw_bytes) #... process tls object # reset accumlation variables. tls_accumulate = False tls_leftover_len = 0 tls_blist = list() else: continue if pkt.haslayer(TCP) and pkt.haslayer(TLS): if not tls_accumulate: # Process new TLS frame. # Pkt over head: ip-hdr-len + tcp-hdr-len ip_tcp_hdr_overhead = ((pkt[IP].ihl*4) + (pkt[TCP].dataofs*4)) pkt_payload_len = (pkt[IP].len - ip_tcp_hdr_overhead) if pkt[TLS].len > pkt_payload_len: # partial TLS frame. Start accumulating. tls_accumulate = True tls_leftover_len = (pkt[TLS].len - pkt_payload_len) tls_blist.append(raw(pkt[TCP].payload)) else: # complete TLS frame # ... process complete TLS frame except Exception as error: pkt.show() print("tcp-processing error: %s", error) sys.exit(-1) except Exception as error: print("packet processing error: %s", error) sys.exit(-1)
