scapy函数介绍

1、读取报文

>>> packets = rdpcap("d.pcap")

2、对于给定的报文，返回一个scapy命令，用于生成该报文

>>> packets[0].command()
"Ether(dst='00:16:3e:33:02:64', src='00:16:3e:5c:f2:a3', type=2048)/IP(version=4, ihl=5, tos=0, len=40, id=1, flags=0, frag=0, ttl=64, proto=6, chksum=13080, src='192.168.5.59', dst='181.42.204.169')/TCP(sport=9468, dport=445, seq=1417283690, ack=483066995, dataofs=5, reserved=0, flags=2, window=8192, chksum=41807, urgptr=0)"

 

3、查看原始数据

>>> raw(packets[0]) 
b'\x00\x16>3\x02d\x00\x16>\\\xf2\xa3\x08\x00E\x00\x00(\x00\x01\x00\x00@\x063\x18\xc0\xa8\x05;\xb5*\xcc\xa9$\xfc\x01\xbdTz\x08j\x1c\xcb\x04sP\x02 \x00\xa3O\x00\x00'

4、16进制数据格式化展示

>>> hexdump(packets[0])
0000  00 16 3E 33 02 64 00 16 3E 5C F2 A3 08 00 45 00  ..>3.d..>\....E.
0010  00 28 00 01 00 00 40 06 33 18 C0 A8 05 3B B5 2A  .(....@.3....;.*
0020  CC A9 24 FC 01 BD 54 7A 08 6A 1C CB 04 73 50 02  ..$...Tz.j...sP.
0030  20 00 A3 4F 00 00

5、展示各层的各字段数据，不便于阅读

>>> ls(packets[0])
dst        : DestMACField                        = '00:16:3e:33:02:64' ('None')
src        : SourceMACField                      = '00:16:3e:5c:f2:a3' ('None')
type       : XShortEnumField                     = 2048            ('36864')
--
version    : BitField  (4 bits)                  = 4               ('4')
ihl        : BitField  (4 bits)                  = 5               ('None')
tos        : XByteField                          = 0               ('0')
len        : ShortField                          = 40              ('None')
id         : ShortField                          = 1               ('1')
flags      : FlagsField                          = <Flag 0 ()>     ('<Flag 0 ()>')
frag       : BitField  (13 bits)                 = 0               ('0')
ttl        : ByteField                           = 64              ('64')
proto      : ByteEnumField                       = 6               ('0')
chksum     : XShortField                         = 13080           ('None')
src        : SourceIPField                       = '192.168.5.59'  ('None')
dst        : DestIPField                         = '181.42.204.169' ('None')
options    : PacketListField                     = []              ('[]')
--
sport      : ShortEnumField                      = 9468            ('20')
dport      : ShortEnumField                      = 445             ('80')
seq        : IntField                            = 1417283690      ('0')
ack        : IntField                            = 483066995       ('0')
dataofs    : BitField  (4 bits)                  = 5               ('None')
reserved   : BitField  (3 bits)                  = 0               ('0')
flags      : FlagsField                          = <Flag 2 (S)>    ('<Flag 2 (S)>')
window     : ShortField                          = 8192            ('8192')
chksum     : XShortField                         = 41807           ('None')
urgptr     : ShortField                          = 0               ('0')
options    : TCPOptionsField                     = []              ("b''")

6、展示概要信息

>>> packets[0].summary()
'Ether / IP / TCP 192.168.5.59:9468 > 181.42.204.169:microsoft_ds S'

7、展示各层的各字段数据，便于阅读

>>> packets[0].show()
###[ Ethernet ]###
  dst       = 00:16:3e:33:02:64
  src       = 00:16:3e:5c:f2:a3
  type      = IPv4
###[ IP ]###
     version   = 4
     ihl       = 5
     tos       = 0x0
     len       = 40
     id        = 1
     flags     =
     frag      = 0
     ttl       = 64
     proto     = tcp
     chksum    = 0x3318
     src       = 192.168.5.59
     dst       = 181.42.204.169
     \options   \
###[ TCP ]###
        sport     = 9468
        dport     = microsoft_ds
        seq       = 1417283690
        ack       = 483066995
        dataofs   = 5
        reserved  = 0
        flags     = S
        window    = 8192
        chksum    = 0xa34f
        urgptr    = 0
        options   = ''