如何使用scapy读取数据包的整个IP层和TCP层？

Question

我正在进行一个TCP重传行为的测试，主要是当收到ICMP的“目的地不可达”（碎片需要，ICMP类型=3，代码=4）消息时，使用的是scapy这个工具。

测试的流程是这样的：
1. 首先建立一个TCP连接到服务器
2. 当TCP连接建立后，发送一个HTTP GET请求给服务器
3. 等待服务器返回HTTP响应
4. 然后向服务器发送一个ICMP类型3代码4的消息，并设置一个小的MTU（最大传输单元）

我的问题是，ICMP类型=3代码=4的消息中包含了IP头和部分TCP头（源地址、目的地址和序列号）来自那个HTTP响应的数据包。目前，我只是从HTTP响应的数据包中读取每个参数（比如IP标识符、碎片标签、生存时间等）。我的问题是：有没有办法从这个数据包中读取完整的IP和TCP头：

ICMP(TYPE=3 CODE=4)/IP头/TCP头

Answer 1

我把数据包对象转换成字典对象，这样解析起来就简单多了。

代码：

from scapy.all import *
from cStringIO import StringIO
import sys
class Capturing(list):
        """
        This class will capture sys.out.
        More info:
        http://stackoverflow.com/questions/16571150/how-to-capture-stdout-output-from-a-python-function-call
        """
    def __enter__(self):
        self._stdout = sys.stdout
        sys.stdout = self._stringio = StringIO()
        return self
    def __exit__(self, *args):
        self.extend(self._stringio.getvalue().splitlines())
        del self._stringio    # free up some memory
        sys.stdout = self._stdout
class PacketDict(dict):
        """
        This class will convert packet into a dict by using the result of packet.show2(). Furthermore the original
        packet will be also saved as attribute '.packet'.
        More class functions could be added, currently only support 'haslayer()'.
        Scapy version: scapy-2.3.3
        """
    def __init__(self, pkt):
        self.packet = pkt
        self.__packet_to_dict()
    def __extract_key(self, line):
        a = line.lstrip("###[ ").rstrip(" ]### ")
        return a
    def __extract_value_to_dict(self, line):
        if line.find("=") > -1:
            b = line.replace(" ","")
            a = b.split("=")
            return {a[0]: a[1]}
        return {line.replace(" ",""): None}
    def __packet_to_dict(self):
        with Capturing() as packet_in_list:
            self.packet.show2()
        current_dict = self
        for line in packet_in_list:
            if line.strip() != "":
                line = line.replace("|","")
                if line.find('###[') > -1:
                    key = self.__extract_key(line)
                    current_dict[key] = {}
                    current_dict = current_dict[key]
                    continue
                current_dict.update(self.__extract_value_to_dict(line))
    def haslayer(self, pkt_cls):
        return self.packet.haslayer(pkt_cls)

if __name__ == "__main__":
    packet_list = rdpcap("/media/sf_ubshare/pcap/test.pcap")
    for packet in packet_list:
        a = PacketDict(packet)
        print a['Ethernet']['IP']['ihl']
        print a.haslayer('ISAKMP')

输出：

/usr/bin/python2.7 /home/yuanzhi/workspace/scaptest/scaptest.py
5L
1

这个字典看起来会是这样的：

{
  "Ethernet": {
    "src": "5e:22:73:12:50:02", 
    "dst": "6e:30:96:e3:a0:6c", 
    "type": "0x800", 
    "IP": {
      "frag": "0L", 
      "src": "1.0.3.0", 
      "UDP": {
        "dport": "isakmp", 
        "ISAKMP": {
          "resp_cookie": "'\\xb5A\\x06\\xef\\x126~\\x95'", 
          "exch_type": "identityprot.", 
          "length": "204", 
          "version": "0x10", 
          "flags": "", 
          "init_cookie": "'2\\x12\\xbda\\xee\\xa8\\xba\\xa6'", 
          "ISAKMP SA": {
            "IKE proposal": {
              "SPI": "''", 
              "length": "44", 
              "IKE Transform": {
                "length": "36", 
                "num": "0", 
                "transforms": "[('Encryption','AES-CBC'),('KeyLength',256),('Hash','SHA'),('Authentication','PSK'),('GroupDesc','1024MODPgr'),('LifeType','Seconds'),('LifeDuration',43200)]", 
                "ISAKMP Vendor ID": {......

Answer 2

希望下面的内容能帮到你：

>>> pkt = ICMP()/IP()/TCP()
>>> ip_header = pkt.getlayer(IP) 
>>> ip_header 
<IP  frag=0 proto=tcp |<TCP  |>>
>>> 

如果你只想获取IP头部信息：

>>> pkt = Ether()/IP()/TCP()
>>> ip = pkt.getlayer(IP)
>>> ip
<IP  frag=0 proto=tcp |<TCP  |>>
>>> ip.remove_payload()
>>> ip
<IP  |>
>>>