Global Header¶
pcapkit.protocols.misc.pcap.header
contains
Header
only,
which implements extractor for global headers *
of PCAP, whose structure is described as below:
typedef struct pcap_hdr_s {
guint32 magic_number; /* magic number */
guint16 version_major; /* major version number */
guint16 version_minor; /* minor version number */
gint32 thiszone; /* GMT to local correction */
guint32 sigfigs; /* accuracy of timestamps */
guint32 snaplen; /* max length of captured packets, in octets */
guint32 network; /* data link type */
} pcap_hdr_t;
- class pcapkit.protocols.misc.pcap.header.Header(file=None, length=None, **kwargs)[source]¶
-
PCAP file global header extractor.
- Parameters
*args (Any) – Arbitrary positional arguments.
**kwargs (Any) – Arbitrary keyword arguments.
- Return type
Protocol[PT]
- __post_init__(file: BinaryIO, length: Optional[int] = None, **kwargs: Any) None [source]¶
- __post_init__(**kwargs: Any) None
Post initialisation hook.
- Parameters
See also
For construction argument, please refer to
make()
.- Return type
- classmethod __index__()[source]¶
Numeral registry index of the protocol.
- Raises
UnsupportedCall – This protocol has no registry entry.
- Return type
- property name: Literal['Global Header']¶
Name of corresponding protocol.
- Return type
Literal
[‘Global Header’]
- property version: VersionInfo¶
Version infomation of input PCAP file.
- Return type
- property payload: NoReturn¶
Payload of current instance.
- Raises
UnsupportedCall – This protocol doesn’t support
payload
.- Return type
- property protochain: NoReturn¶
Protocol chain of current instance.
- Raises
UnsupportedCall – This protocol doesn’t support
protochain
.- Return type
- property byteorder: Literal['big', 'little']¶
Header byte order.
- Return type
Literal
[‘big’, ‘little’]
- read(length=None, **kwargs)[source]¶
Read global header of PCAP file.
Notes
PCAP file has four different valid magic numbers.
d4 c3 b2 a1
– Little-endian microsecond-timestamp PCAP file.a1 b2 c3 d4
– Big-endian microsecond-timestamp PCAP file.4d 3c b2 a1
– Little-endian nanosecond-timestamp PCAP file.a1 b2 3c 4d
– Big-endian nano-timestamp PCAP file.
- make(*, byteorder='little', lilendian=None, bigendian=None, nanosecond=False, version=(2, 4), version_major=None, version_minor=None, thiszone=0, sigfigs=0, snaplen=262144, network=LinkType.NULL, network_default=None, network_namespace=None, network_reversed=False, **kwargs)[source]¶
Make (construct) packet data.
- Parameters
byteorder (Literal["big", "little"]) – header byte order
lilendian (Optional[bool]) – little-endian flag
bigendian (Optional[bool]) – big-endian flag
nanosecond (bool) – nanosecond-resolution file flag
version (tuple[int, int] | VersionInfo) – version information
version_major (Optional[int]) – major version number
version_minor (Optional[int]) – minor version number
thiszone (int) – GMT to local correction
sigfigs (int) – accuracy of timestamps
snaplen (int) – max length of captured packets, in octets
network (RegType_LinkType | StdlibEnum | AenumEnum | str | int) – data link type
network_default (Optional[int]) – default value for unknown data link type
network_namespace (Optional[dict[str, int] | dict[int, str] | Type[StdlibEnum] | Type[AenumEnum]]) – data link type namespace
network_reversed (bool) – if namespace is
str -> int
pairs**kwargs (Any) – Arbitrary keyword arguments.
- Returns
Constructed packet data.
- Return type
Data Structures¶
- class pcapkit.protocols.data.misc.pcap.header.Header(magic_number, version_major, version_minor, thiszone, sigfigs, snaplen, network)[source]¶
Bases:
Info
Global header of PCAP file.
- Parameters
*args (VT) – Arbitrary positional arguments.
**kwargs (VT) – Arbitrary keyword arguments.
- Return type
- magic_number: MagicNumber¶
Magic number.
- version: VersionInfo¶
Version number.
- class pcapkit.protocols.data.misc.pcap.header.MagicNumber(data, byteorder, nanosecond)[source]¶
Bases:
Info
Magic number of PCAP file.
- Parameters
*args (VT) – Arbitrary positional arguments.
**kwargs (VT) – Arbitrary keyword arguments.
- Return type
- byteorder: Literal['big', 'little']¶
Byte order.