Python. Class, Struct, Dictionary?

Question

I am disassembling TCP/IP packet into string format. What is the best way to structure and store it? Should I store it as a ctypes struct, python class, dictionary, or some other way? What are the pros and cons of each method?

Answer 1

You should use a class. It gives you the most flexibility to grow in the future.

Dictionaries have more verbose syntax to access their contents, and don't allow you to add methods if you need them.

ctypes is really for accessing structures packed for use in other APIs. If your data is going to stay in Python, the only benefit is that it will be more compact in memory.

Answer 2

Im a big fan of dictionaries for things like this because

1. You can do things like thisPacket['srcPort']
2. You can then just shove your packets into something like MongoDB and query them later in cool ways (i.e. give me every packet that came in on port 80 and was from some subnet with a particular flag set)