Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Get all the layers in a packet

Tags:

python

scapy

How can I get a list of all the layers in scapy? Eg: Ether/IP/UDP/DNS or Ether/IP/TCP/HTTP. The only thing I can think of is to do a packet.summary() and parse the output, which seems very crude. I think there should be a method built-in, but cannot find any in the documentation. Any suggestions?

What I am trying to do is to iterate over all the fields of a specific protocol given by a user and display its values.

Update: What I am looking for exactly can be seen in wireshark: Open any capture, select a packet, and in the 'Frame' menu, one can see Protocols in frame: eth:ip:udp:data This is exactly what I am looking for in Scapy. I hope I am clearer now.

like image 449
krish7919 Avatar asked Nov 25 '12 07:11

krish7919


2 Answers

Use packet.getLayer(<id>) in a loop. For example:

from scapy.all import Ether

def get_packet_layers(packet):
    counter = 0
    while True:
        layer = packet.getlayer(counter)
        if layer is None:
            break

        yield layer
        counter += 1


packet = 'ffffffffffff00ffd59c64320806000108000604000100ffd59c6432000000000000000000000a000001'.decode('hex')
packet = Ether(_pkt=packet)

for layer in get_packet_layers(packet):
    print (layer.name)

outputs

Ethernet
ARP
like image 56
krish7919 Avatar answered Oct 27 '22 15:10

krish7919


Each additional layer is the payload of a packet, so you can iterate

def expand(x):
    yield x
    while x.payload:
        x = x.payload
        yield x

and then

res = list(expand(packet))

I hope that is what you meant.

like image 23
cronos Avatar answered Oct 27 '22 13:10

cronos