On Sat, 05 Feb 2005 06:51:32 -0700, Earl Eiland <[EMAIL PROTECTED]> wrote:
> I'm trying to process the IP packet length field, as recorded by pcap
> (Ethereal) and recovered using pcapy. When I slice out those bytes, I
> get a value that shows in '\x00' format, rather than '0x00'. Neither
> int() nor eval() are working. How do I handle this?
>From my unpublished protocol analyzing hack:
class Ip:
"IPv4 header"
def __init__(self, frame):
(vi, tos, tlen,
id, ffoff,
ttl, proto, checksum,
source,
dest) = struct.unpack('! BBH HH BBH LL', frame[:20])
self.len = 4 * (vi & 0xf)
if proto==6:
self.proto=Tcp
elif proto==17:
self.proto=Udp
elif proto==1:
self.proto=Icmp
self.source = Address(source)
self.dest = Address(dest)
That doesn't take IP options into account (or are they part of Ip.len? I
forget.), but it has the nifty feature that IP.proto tells the caller what
factory function (if any) she should feed the rest of the frame into.
/Jorgen
--
// Jorgen Grahn <jgrahn@ Ph'nglui mglw'nafh Cthulhu
\X/ algonet.se> R'lyeh wgah'nagl fhtagn!
--
http://mail.python.org/mailman/listinfo/python-list
