python-dpkt：解析ICMP數據包

如何解析ICMP數據包（使用dpkt）來檢查它是否是從A到B的請求或響應？python-dpkt：解析ICMP數據包

我發現了TCP和UDP數據包的一些例子（下面），但我找不到任何IP數據包。

import dpkt 

f = open('test.pcap') 
pcap = dpkt.pcap.Reader(f) 

for ts, buf in pcap: 
    eth = dpkt.ethernet.Ethernet(buf) 
    ip = eth.data 
    tcp = ip.data 

    if tcp.dport == 80 and len(tcp.data) > 0: 
     http = dpkt.http.Request(tcp.data) 
     print http.uri 

f.close()

另外，有沒有什麼好的教程dpkt？

來源

2014-02-18 gspt

https://github.com/kbandla/ dpkt – Misha

這是一個古老的問題，但對於遇到這種問題的人來說，我已經向dpkt回購添加了ICMP示例。該文檔可以在這裏找到：http://dpkt.readthedocs.io/en/latest/print_icmp.html和示例代碼可在dpkt /實施例中找到/ print_icmp.py

# For each packet in the pcap process the contents 
for timestamp, buf in pcap: 

    # Unpack the Ethernet frame (mac src/dst, ethertype) 
    eth = dpkt.ethernet.Ethernet(buf) 

    # Make sure the Ethernet data contains an IP packet 
    if not isinstance(eth.data, dpkt.ip.IP): 
     print 'Non IP Packet type not supported %s\n' % eth.data.__class__.__name__ 
     continue 

    # Now grab the data within the Ethernet frame (the IP packet) 
    ip = eth.data 

    # Now check if this is an ICMP packet 
    if isinstance(ip.data, dpkt.icmp.ICMP): 
     icmp = ip.data 

     # Pull out fragment information 
     do_not_fragment = bool(ip.off & dpkt.ip.IP_DF) 
     more_fragments = bool(ip.off & dpkt.ip.IP_MF) 
     fragment_offset = ip.off & dpkt.ip.IP_OFFMASK 

     # Print out the info 
     print 'Timestamp: ', str(datetime.datetime.utcfromtimestamp(timestamp)) 
     print 'Ethernet Frame: ', mac_addr(eth.src), mac_addr(eth.dst), eth.type 
     print 'IP: %s -> %s (len=%d ttl=%d DF=%d MF=%d offset=%d)' % \ 
       (inet_to_str(ip.src), inet_to_str(ip.dst), ip.len, ip.ttl, 
       do_not_fragment, more_fragments, fragment_offset) 
     print 'ICMP: type:%d code:%d checksum:%d data: %s\n' % (icmp.type, 
       icmp.code, icmp.sum, repr(icmp.data))

示例輸出

Timestamp: 2013-05-30 22:45:17.283187 
Ethernet Frame: 60:33:4b:13:c5:58 02:1a:11:f0:c8:3b 2048 
IP: 192.168.43.9 -> 8.8.8.8 (len=84 ttl=64 DF=0 MF=0 offset=0) 
ICMP: type:8 code:0 checksum:48051 data: Echo(id=55099, data='Q\xa7\xd6}\x00\x04Q\xe4\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&\'()*+,-./') 

Timestamp: 2013-05-30 22:45:17.775391 
Ethernet Frame: 02:1a:11:f0:c8:3b 60:33:4b:13:c5:58 2048 
IP: 8.8.8.8 -> 192.168.43.9 (len=84 ttl=40 DF=0 MF=0 offset=0) 
ICMP: type:0 code:0 checksum:50099 data: Echo(id=55099, data='Q\xa7\xd6}\x00\x04Q\xe4\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&\'()*+,-./')

來源

2016-08-23 01:34:43

python-dpkt：解析ICMP數據包

回答

相關問題