TCP packet segment python

Question

I'm handling TCP packets. This application acts as an sniffer and builds up SIP Packets. Some TCP SIP packets come fragmented hence I need to reassemble them.

What I do is that Initially I process first TCP connection using:

packet = s.recvfrom(sipLocatorConfig.NETWORK_MAX_SIZE)

After that I obtain the data and then if fragmented I get the rest but using .recv :

socket.recv(sipLocatorConfig.NETWORK_TCP_MAX_SIZE)

When I obtained the second fragment, I get garbled data at the beginning when using .recv , which I assume is the ETH, IP, TCP info:

M*?
M*?@{
QyE

How can I remove this ETH, IP and TCP header info and extract just the data from Packet? Thanks

Answer 1

You can parse the packet as:

• First 14 bytes is ethernet header
• Next 20 bytes is probably ip header
• similarly,from ip header, we can extract protocol we are using and finally see the protocol reference to parse data out of it

Eg. TCP connection packet comes as : eth_header+IP_header+TCP_Header+payload(data) Each header have their specific length and extracting informations out of the headers would require you to use struct modules in python (see struct.unpack("","")). Extracting header infos also would require knowledge of the structure of headers. Finally you can calculate the payload position and finally extract it.

Specifically, please see this link for more information. Hope this helps