在 scapy 中使用方括号作为数据包头

Question

I have a question related to the data we get when use square brackets in scapy.

Reference code:

#!/usr/bin/python3
from scapy.all import *

def spoof_pkt(pkt):
    a = pkt[IP]

pkt = sniff(filter='tcp',prn=spoof_pkt)

The above code tries to sniff tcp packet. My question is that when I use a syntax like pkt[IP] in scapy, do I get just the IP header, or do I get the entire packet starting from the IP header ?

Answer 1

You will get the entire packet including and following the IP header:

>>> a = Ether()/IP()/ICMP()
>>> a[IP]
<IP  frag=0 proto=icmp |<ICMP  |>>

If you wanted only the IP layer, you would have to remove its payload:

>>> c = a.copy()[IP]
>>> c.remove_payload()
>>> c
<IP  |>

Note that a packet and all its sub fields are mutable