Search code examples
pythonscapy

How to import a packet to scapy as a byte stream?


Say i have a single packet as a byte-stream. I took it from the Wireshark via "Copy as a byte stream" context menu item. Like this: "6c410ead2be80050568a52d60800450004137bbd40004006419c0a0005342d863cd260ee0540510a37024a9554ff8018014b7d9100000101080a38cdaa36005e4184524553504d4f....." and so on. There is a full stack of layesrs, from l2 to l7. How do i create a correct packet in scapy from this stuff?


Solution

  • I was able to get your string parsed (or, at least what of the string you included) as follows:

    from scapy.layers.l2 import Ether
    from scapy.all import *
    
    b = "6c410ead2be80050568a52d60800450004137bbd40004006419c0a0005342d863cd260ee0540510a37024a9554ff8018014b7d9100000101080a38cdaa36005e4184524553504d4f4420696361703a2f2f34352e3133342e36302e3231303a313334"
    bs = bytes.fromhex(b)
    ether = Ether(bs)
    ether.show()
    

    I won't show the output here because it looks like there might be some potentially sensitive information in there? It appears to be parsed fine though. It shows an IP layer with a type of 4, the MAC addresses correspond to a VMWare computer and Cisco device, and other sensical information.

    The wildcard import could be avoided by manually importing the layers you need.