DPKT Tools

pcapkit.toolkit.dpkt contains all you need for pcapkit handy usage with DPKT engine. All reforming functions returns with a flag to indicate if usable for its caller.

pcapkit.toolkit.dpkt.ipv4_reassembly(packet, *, count=NotImplemented)

Make data for IPv4 reassembly.

Parameters

packet (dpkt.dpkt.Packet) – DPKT packet.

Keyword Arguments

count (int) – Packet index. If not provided, default to NotImplemented.

Returns

A tuple of data for IPv4 reassembly.

• If the packet can be used for IPv4 reassembly. A packet can be reassembled if it contains IPv4 layer (dpkt.ip.IP) and the DF (dpkt.ip.IP.df) flag is False.

• If the packet can be reassembled, then the dict mapping of data for IPv4 reassembly (ipv4.packet) will be returned; otherwise, returns None.

Return type

Tuple[bool, Dict[str, Any]]

See also

IPv4Reassembly

pcapkit.toolkit.dpkt.ipv6_hdr_len(ipv6)

Calculate length of headers before IPv6 Fragment header.

Parameters

ipv6 (dpkt.ip6.IP6) – DPKT IPv6 packet.

Returns

Length of headers before IPv6 Fragment header dpkt.ip6.IP6FragmentHeader (RFC 2460#section-4.5).

Return type

int

As specified in RFC 2460#section-4.1, such headers (before the IPv6 Fragment Header) includes Hop-by-Hop Options header dpkt.ip6.IP6HopOptsHeader (RFC 2460#section-4.3), Destination Options header dpkt.ip6.IP6DstOptHeader (RFC 2460#section-4.6) and Routing header dpkt.ip6.IP6RoutingHeader (RFC 2460#section-4.4).

pcapkit.toolkit.dpkt.ipv6_reassembly(packet, *, count=NotImplemented)

Make data for IPv6 reassembly.

Parameters

packet (dpkt.dpkt.Packet) – DPKT packet.

Keyword Arguments

count (int) – Packet index. If not provided, default to NotImplemented.

Returns

A tuple of data for IPv6 reassembly.

• If the packet can be used for IPv6 reassembly. A packet can be reassembled if it contains IPv6 layer (dpkt.ip6.IP6) and IPv6 Fragment header (RFC 2460#section-4.5, dpkt.ip6.IP6FragmentHeader).

• If the packet can be reassembled, then the dict mapping of data for IPv6 reassembly (ipv6.packet) will be returned; otherwise, returns None.

Return type

Tuple[bool, Dict[str, Any]]

See also

IPv6Reassembly

pcapkit.toolkit.dpkt.packet2chain(packet)

Fetch DPKT packet protocol chain.

Parameters

packet (dpkt.dpkt.Packet) – DPKT packet.

Returns

Colon (:) seperated list of protocol chain.

Return type

str

pcapkit.toolkit.dpkt.packet2dict(packet, timestamp, *, data_link)

Convert DPKT packet into dict.

Parameters

packet (c) – Scapy packet.

Returns

A dict mapping of packet data.

Return type

Dict[str, Any]

pcapkit.toolkit.dpkt.tcp_reassembly(packet, *, count=NotImplemented)

Make data for TCP reassembly.

Parameters

packet (dpkt.dpkt.Packet) – DPKT packet.

Keyword Arguments

count (int) – Packet index. If not provided, default to NotImplemented.

Returns

A tuple of data for TCP reassembly.

• If the packet can be used for TCP reassembly. A packet can be reassembled if it contains TCP layer (dpkt.tcp.TCP).

• If the packet can be reassembled, then the dict mapping of data for TCP reassembly (tcp.packet) will be returned; otherwise, returns None.

Return type

Tuple[bool, Dict[str, Any]]

See also

TCPReassembly

pcapkit.toolkit.dpkt.tcp_traceflow(packet, timestamp, *, data_link, count=NotImplemented)

Trace packet flow for TCP.

Parameters

• packet (dpkt.dpkt.Packet) – DPKT packet.

• timestamp (float) – Timestamp of the packet.

Keyword Arguments

• data_link (str) – Data link layer protocol (from global header).

• count (int) – Packet index. If not provided, default to NotImplemented.

Returns

A tuple of data for TCP reassembly.

• If the packet can be used for TCP flow tracing. A packet can be reassembled if it contains TCP layer (dpkt.tcp.TCP).

• If the packet can be reassembled, then the dict mapping of data for TCP flow tracing (trace.packet) will be returned; otherwise, returns None.

Return type

Tuple[bool, Dict[str, Any]]

See also

TraceFlow