Scapy Tools

pcapkit.toolkit.scapy contains all you need for pcapkit handy usage with Scapy engine. All reforming functions returns with a flag to indicate if usable for its caller.

Warning

This module requires installed Scapy engine.

pcapkit.toolkit.scapy.ipv4_reassembly(packet, *, count=-1)

Make data for IPv4 reassembly.

Parameters

• packet (Packet) – Scapy packet.

• count (int) – Packet index. If not provided, default to -1.

Return type

IP_Packet[IPv4Address] | None

Returns

Data for IPv4 reassembly.

• If the packet can be used for IPv4 reassembly. A packet can be reassembled if it contains IPv4 layer (scapy.layers.inet.IP) and the DF (scapy.layers.inet.IP.flags.DF) flag is False.

• If the packet can be reassembled, then the dict mapping of data for IPv4 reassembly (ipv4.packet) will be returned; otherwise, returns None.

See also

pcapkit.foundation.reassembly.ipv4.IPv4Reassembly

pcapkit.toolkit.scapy.ipv6_reassembly(packet, *, count=-1)

Make data for IPv6 reassembly.

Parameters

• packet (Packet) – Scapy packet.

• count (int) – Packet index. If not provided, default to -1.

Return type

IP_Packet[IPv6Address] | None

Returns

Data for IPv6 reassembly.

• If the packet can be used for IPv6 reassembly. A packet can be reassembled if it contains IPv6 layer (scapy.layers.inet6.IPv6) and IPv6 Fragment header (RFC 2460#section-4.5, scapy.layers.inet6.IPv6ExtHdrFragment).

• If the packet can be reassembled, then the dict mapping of data for IPv6 reassembly (ipv6.packet) will be returned; otherwise, returns None.

Raises

ModuleNotFound – If Scapy is not installed.

See also

pcapkit.foundation.reassembly.ipv6.IPv6Reassembly

pcapkit.toolkit.scapy.tcp_reassembly(packet, *, count=-1)

Store data for TCP reassembly.

Parameters

• packet (Packet) – Scapy packet.

• count (int) – Packet index. If not provided, default to -1.

Return type

TCP_Packet | None

Returns

Data for TCP reassembly.

• If the packet can be used for TCP reassembly. A packet can be reassembled if it contains TCP layer (scapy.layers.inet.TCP).

• If the packet can be reassembled, then the dict mapping of data for TCP reassembly (tcp.packet) will be returned; otherwise, returns None.

See also

pcapkit.foundation.reassembly.tcp.TCPReassembly

pcapkit.toolkit.scapy.tcp_traceflow(packet, *, count=-1)

Trace packet flow for TCP.

Parameters

• packet (Packet) – Scapy packet.

• count (int) – Packet index. If not provided, default to -1.

Return type

TF_Packet | None

Returns

Data for TCP reassembly.

• If the packet can be used for TCP flow tracing. A packet can be reassembled if it contains TCP layer (scapy.layers.inet.TCP).

• If the packet can be reassembled, then the dict mapping of data for TCP flow tracing (trace.packet) will be returned; otherwise, returns None.

See also

pcapkit.foundation.traceflow.TraceFlow

pcapkit.toolkit.scapy.packet2chain(packet)

Fetch Scapy packet protocol chain.

Parameters

packet (Packet) – Scapy packet.

Return type

str

Returns

Colon (:) seperated list of protocol chain.

Raises

ModuleNotFound – If Scapy is not installed.

pcapkit.toolkit.scapy.packet2dict(packet)

Convert Scapy packet into dict.

Parameters

packet (Packet) – Scapy packet.

Return type

dict[str, Any]

Returns

A dict mapping of packet data.

Raises

ModuleNotFound – If Scapy is not installed.