python - Parsing ip address with dpkt -


i using dpkt parse pcap file, confused how extract destination ip address. parsing packets using eth = dpkt.ethernet.ethernet(buf) returns ethernet object looks following:

ethernet(src='\x00\x1a\xa0kuf', dst='\x00\x13i\xae\x84,', data=ip(src='\xc0\xa8\n\n', off=16384, dst='c\x17\x030', sum=25129, len=52, p=6, id=51105, data=tcp(seq=9632694, off_x2=128, ack=3382015884, win=54, sum=65372, flags=17, dport=80, sport=56145))) 

i confused 2 things.

  1. should grabbing dst field in ethernet, or 1 in ip (ethernet.data)?
  2. how can turn these weird strings ip addresses of form x.x.x.x x integer 0-255?

i tried solution convert "little endian" hex string ip address in python, both dst fields seem contain data seemingly cannot parsed ip address such _daq (how _daq parsed address?) or rt\x00\x125\x02 (what rt?) or 33\x00\x01\x00\x03 (what 33 @ beginning , why 5 bytes not 4?)

  1. the eth.dst field contain destination mac address (e.g. 01:23:45:67:89:ab), not destination ip address. need ip.dst field.
  2. the strings byte strings, rather ascii (or otherwise) encoded readable character strings.

try this:

ip_hdr = eth.data ip_hdr.dst  # contain destination ip address in binary  # adapted http://www.commercialventvac.com/dpkt.html#moztocid303989 import socket dst_ip_addr_str = socket.inet_ntoa(ip_hdr.dst) 

Comments

Popular posts from this blog

java - How to specify maven bin in eclipse maven plugin? -

single sign on - Logging into Plone site with credentials passed through HTTP -

php - Why does AJAX not process login form? -