Search code examples
pythontcppacketpacket-capturescapy

Get TCP Flags with Scapy


I'm parsing a PCAP file and I need to extract TCP flags (SYN, ACK, PSH, URG, ...). I'm using the packet['TCP'].flags value to obtain all the flags at once.

pkts = PcapReader(infile)
for p in pkts:
        F = bin(p['TCP'].flags)
        print F, bin(F), p.summary()
        # manual flags extraction from F

Is there a way to obtain a single TCP flag without manually extract it from packet['TCP'].flags value?


Solution

  • Normally, the usual way to handle FLAGS is with a bitmap and bitwise operators. If your Packet class doesn't have specific method to test for flags, the best thing you can do IMHO is to:

    FIN = 0x01
    SYN = 0x02
    RST = 0x04
    PSH = 0x08
    ACK = 0x10
    URG = 0x20
    ECE = 0x40
    CWR = 0x80
    

    And test them like this:

    F = p['TCP'].flags    # this should give you an integer
    if F & FIN:
        # FIN flag activated
    if F & SYN:
        # SYN flag activated
    # rest of the flags here
    

    Sadly, python doesn't have a switch statement to make this more elegant but it doesn't really matter much.

    Hope this helps!