Search code examples
pythonscapy

Increment PCAP timestamp values


Scapy has the capability to modify timestamps on a per packet basis therefore am wondering what might be the best way to modify the the timestamps on a number of packets in a PCAP by specifying a start value. I am able to modify the packets but have yet to successfully increment the microseconds value.

For example would like to modify packets timestamps in a PCAP which contains:

1360806997.231777 IP 192.168.1.100.50496 > 192.168.1.200.http: S 4211078664:4211078664(0) win 14600 <mss 1460,sackOK,timestamp 199086437 0,nop,wscale 3>
1360806997.231808 IP 192.168.1.200.http > 192.168.1.100.50496: S 256066681:256066681(0) ack 4211078665 win 14480 <mss 1460,sackOK,timestamp 199086195 199086437,nop,wscale 3>
1360806997.232034 IP 192.168.1.100.50496 > 192.168.1.200.http: . ack 1 win 1825 <nop,nop,timestamp 199086437 199086195>
1360806997.232043 IP 192.168.1.100.50496 > 192.168.1.200.http: P 1:19(18) ack 1 win 1825 <nop,nop,timestamp 199086437 199086195>
1360806997.232063 IP 192.168.1.200.http > 192.168.1.100.50496: . ack 19 win 1810 <nop,nop,timestamp 199086195 199086437>

to the following:

1234567890.000000 IP 192.168.1.100.50496 > 192.168.1.200.http: S 4211078664:4211078664(0) win 14600 <mss 1460,sackOK,timestamp 199086437 0,nop,wscale 3>
1234567890.000001 IP 192.168.1.200.http > 192.168.1.100.50496: S 256066681:256066681(0) ack 4211078665 win 14480 <mss 1460,sackOK,timestamp 199086195 199086437,nop,wscale 3>
1234567890.000002 IP 192.168.1.100.50496 > 192.168.1.200.http: . ack 1 win 1825 <nop,nop,timestamp 199086437 199086195>
1234567890.000003 IP 192.168.1.100.50496 > 192.168.1.200.http: P 1:19(18) ack 1 win 1825 <nop,nop,timestamp 199086437 199086195>
1234567890.000004 IP 192.168.1.200.http > 192.168.1.100.50496: . ack 19 win 1810 <nop,nop,timestamp 199086195 199086437>

Solution

  • This seems to work:

    def process_packets():
        pkts = rdpcap(infile)
        cooked=[]
        timestamp = 1234567890.000000
        for p in pkts:
            p.time = timestamp
            timestamp += 0.000001
            pmod=p
            cooked.append(pmod)
        wrpcap("dump.pcap", cooked)
    

    Code will write new time value for each packet to a new PCAP with the specified second and increment the microsecond value. If there's a more graceful method, please let me know.