python - Parsing ip address with dpkt -
i using dpkt parse pcap file, confused how extract destination ip address. parsing packets using eth = dpkt.ethernet.ethernet(buf) returns ethernet object looks following:
ethernet(src='\x00\x1a\xa0kuf', dst='\x00\x13i\xae\x84,', data=ip(src='\xc0\xa8\n\n', off=16384, dst='c\x17\x030', sum=25129, len=52, p=6, id=51105, data=tcp(seq=9632694, off_x2=128, ack=3382015884, win=54, sum=65372, flags=17, dport=80, sport=56145))) i confused 2 things.
- should grabbing dst field in ethernet, or 1 in ip (ethernet.data)?
- how can turn these weird strings ip addresses of form x.x.x.x x integer 0-255?
i tried solution convert "little endian" hex string ip address in python, both dst fields seem contain data seemingly cannot parsed ip address such _daq (how _daq parsed address?) or rt\x00\x125\x02 (what rt?) or 33\x00\x01\x00\x03 (what 33 @ beginning , why 5 bytes not 4?)
- the
eth.dstfield contain destination mac address (e.g.01:23:45:67:89:ab), not destination ip address. need ip.dst field. - the strings byte strings, rather ascii (or otherwise) encoded readable character strings.
try this:
ip_hdr = eth.data ip_hdr.dst # contain destination ip address in binary # adapted http://www.commercialventvac.com/dpkt.html#moztocid303989 import socket dst_ip_addr_str = socket.inet_ntoa(ip_hdr.dst)
Comments
Post a Comment