Scapy：如何访问自定义层

我想了解如何在Scapy中添加自定义解剖器。如果对结果有任何影响，我正在使用Python 3.4和Scapy3。Scapy：如何访问自定义层

我有一个愚蠢的类，并且packet.show2（）命令正确地呈现嵌套数据包。但我无法访问新的图层字段值。

可怕类和bind_layer如下...

from scapy.all import * 
#Create simple Class 
class DUMBO(Packet): 
    fields_desc = [ 
     ShortField('ears',0), 
     ShortField('legs',0), 
     ShortField('trunk',0) 
    ] 
#Inform TCP that ports 9898 are this protocol 
bind_layers(TCP, DUMBO, sport=9898, dport=9898)

我做的我已经使用LS产创建的数据包这样

#Make a Packet 
pack=IP()/TCP(sport=9898, dport=9898)/Raw(load=b'\x00\x02\x00\x04\x00\x01')

包寻找

version : BitField    = 4    (4) 
ihl  : BitField    = None   (None) 
tos  : XByteField   = 0    (0) 
len  : ShortField   = None   (None) 
id   : ShortField   = 1    (1) 
flags  : FlagsField   = 0    (0) 
frag  : BitField    = 0    (0) 
ttl  : ByteField   = 64    (64) 
proto  : ByteEnumField  = 6    (0) 
chksum  : XShortField   = None   (None) 
src  : Emph     = '127.0.0.1'  (None) 
dst  : Emph     = '127.0.0.1'  ('127.0.0.1') 
options : PacketListField  = []    ([]) 
-- 
sport  : ShortEnumField  = 9898   (20) 
dport  : ShortEnumField  = 9898   (80) 
seq  : IntField    = 0    (0) 
ack  : IntField    = 0    (0) 
dataofs : BitField    = None   (None) 
reserved : BitField    = 0    (0) 
flags  : FlagsField   = 2    (2) 
window  : ShortField   = 8192   (8192) 
chksum  : XShortField   = None   (None) 
urgptr  : ShortField   = 0    (0) 
options : TCPOptionsField  = {}    ({}) 
-- 
load  : StrField    = b'\x00\x02\x00\x04\x00\x01' (b'')

而且使用Show2显示它一切都很好

pack.show2() 


###[ IP ]### 
    version = 4 
    ihl  = 5 
    tos  = 0x0 
    len  = 46 
    id  = 1 
    flags  = 
    frag  = 0 
    ttl  = 64 
    proto  = tcp 
    chksum = 0x7cc7 
    src  = 127.0.0.1 
    dst  = 127.0.0.1 
    \options \ 
###[ TCP ]### 
    sport  = monkeycom 
    dport  = monkeycom 
    seq  = 0 
    ack  = 0 
    dataofs = 5 
    reserved = 0 
    flags  = S 
    window = 8192 
    chksum = 0x447f 
    urgptr = 0 
    options = [] 
###[ DUMBO ]### 
     ears  = 2 
     legs  = 4 
     trunk  = 1

我现在要访问的DUMBO层中的字段

但 PACK [DUMBO] .ears

是不正确的 - 当为pack.show（显示为数据包）仍具有Payload as Raw ....

我在想什么？

来源

2016-05-09 Tim Seed

好了 - 这是我的解决方案....

pack=IP()/TCP(sport=19898, dport=19898)/Raw(load=b'\x00\x02\x00\x04\x00\x01') 

    #Cast this packet back 
    pack=IP(bytes(pack)) 
    pack.show2() 
    pack.show() 
    if DUMBO in pack: 
     print('Elephant in the house') 
     print('Ears -> {}'.format(pack[DUMBO].ears))

如果任何人都可以在这个提高我会在看到该解决方案开心。

来源

2016-05-10 07:34:20

Scapy：如何访问自定义层

回答

相关问题