且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

将原始 Scapy 数据解码为人类可读

更新时间:2023-09-11 13:36:40

首先,您的脚本中有错误.raw = pkt.lastlayer() 应该是 raw = packet.lastlayer().

First, you have an error in your script. raw = pkt.lastlayer() should be raw = packet.lastlayer().

尝试将 print(packet.show()) 添加到您的脚本中以获得更具可读性的格式,这将为您提供类似的内容:

Try adding print(packet.show()) to your script for a more readable format which will give you something similar to this:

###[ Ethernet ]###
  dst       = 94:c6:91:1c:68:c3
  src       = 94:c6:91:1c:68:1d
  type      = 0x800
###[ IP ]###
     version   = 4
     ihl       = 5
     tos       = 0x0
     len       = 84
     id        = 49689
     flags     = DF
     frag      = 0
     ttl       = 64
     proto     = icmp
     chksum    = 0x1938
     src       = 192.168.111.4
     dst       = 192.168.111.2
     \options   \
###[ ICMP ]###
        type      = echo-request
        code      = 0
        chksum    = 0xb468
        id        = 0x6d3
        seq       = 0xab
###[ Raw ]###
           load      = '\x0e\x85\x96[\x00\x00\x00\x00\xd2e\x06\x00\x00\x00\x00\x00\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&\'()*+,-./01234567'

None

您还可以使用 hexdump 命令以更易读的格式显示原始负载.

You can also use hexdump command to show the raw load in a more readable format.

from scapy.utils import hexdump
raw = packet.lastlayer()
hexdump(raw)

输出如下:

0000  D091965B0000000080FD0E0000000000 ...[............
0010  101112131415161718191A1B1C1D1E1F ................
0020  202122232425262728292A2B2C2D2E2F  !"#$%&'()*+,-./
0030  3031323334353637                 01234567
0000  063814054CC2886E4B0078000000C294 .8..L..nK.x.....
0010  08C2880000C3BFC3BFC3BFC3BF000000 ................
0020  00000000000000000000000000000100 ................
0030  0000C29F000002200001736AC29BC3B4 ....... ..sj....
0040  00000000000000000000000470000800 ............p...
0050  000000000064C3A9593C000000000000 .....d..Y<......
0060  0000000004C28C000011330000000100 ..........3.....
0070  020C0000000102000000043131383700 ...........1187.
0080  00000000                         ....