Decompress Hex bytes data using lz4

Question

First, the udp broadcast data was captured using tcpdump, where one of the packets (all packets similar) looks something like this.

11:14:54.952531 IP (tos 0x0, ttl 64, id 20499, offset 0, flags [none], proto UDP (17), length 540)
192.168.200.20.28190 > 233.1.2.5.28190: [udp sum ok] UDP, length 512
0x0000:  4500 021c 5013 0000 4011 b4fa c0a8 c814  E...P...@.......
0x0010:  e901 0205 6e1e 6e1e 0208 500d 0220 0001  ....n.n...P.....
0x0020:  00aa 1a02 595a 2a2a 3132 3300 4000 0546  ....YZ**123.@..F
0x0030:  5573 ae00 001c 2b40 2802 01c9 2520 00e0  Us....+@(...%...
0x0040:  4c01 a2fd 3520 a002 00cc 0046 c1c2 000c  L...5......F....
0x0050:  03b5 3b00 1b00 1f80 bc00 0896 bb80 41e6  ..;...........A.
0x0060:  065b f100 0003 0002 0001 6da0 ffff feed  .[........m.....
0x0070:  0001 0000 4160 25e8 7e09 605d de40 7f00  ....A`%.~.`].@..
0x0080:  79e0 4025 d960 4d2e 6025 d440 4e01 5a60  y.@%.`M.`%.@N.Z`
0x0090:  25f2 40ef 034b c040 27f7 0005 0026 3900  %.@..K.@'....&9.
0x00a0:  5dfc 609d 5d40 4dff 001d 0400 4dfd 409c  ].`.]@M.....M.@.
0x00b0:  02ff 0641 1aa9 825c 0141 32f8 4060 1c61  ...A...\.A2.@`.a
0x00c0:  b460 fc61 3460 1c62 4c11 0000 0000 0000  .`.a4`.bL.......
0x00d0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x00e0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x00f0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x0100:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x0110:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x0120:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x0130:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x0140:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x0150:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x0160:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x0170:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x0180:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x0190:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x01a0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x01b0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x01c0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x01d0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x01e0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x01f0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x0200:  0000 0000 0000 0000 0000 0000 0000 0000  ................
0x0210:  0000 0000 0000 0000 0000 0000            ............

From here, by fetching the data block, the byte wise compressed data is given below which is encoded using LZ4 compression algorithm.

Any suggestions on how to decompress and get the actual data, the compressed data looks something like this.

0220 0001 00aa 1a02 595a 2a2a 3132 3300 4000 0546 5573 ae00 001c 2b40 2802 01c9 2520 00e0 4c01 a2fd 3520 a002 00cc 0046 c1c2 000c 03b5 3b00 1b00 1f80 bc00 0896 bb80 41e6 065b f100 0003 0002 0001 6da0 ffff feed 0001 0000 4160 25e8 7e09 605d de40 7f00 79e0 4025 d960 4d2e 6025 d440 4e01 5a60 25f2 40ef 034b c040 27f7 0005 0026 3900 5dfc 609d 5d40 4dff 001d 0400 4dfd 409c 02ff 0641 1aa9 825c 0141 32f8 4060 1c61 b460 fc61 3460 1c62 4c11 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 ....

Answer 1

Question : ... is encoded using LZ4 compression algorithm. Any suggestions on how to decompress ...

Try this module: python-lz4 Quickstart

The recommended binding to use is the LZ4 frame format. The simplest way to use the frame package is to import the compress and decompress functions:

>>> import os
>>> from lz4.frame import compress, decompress
>>> input_data = os.urandom(20 * 128 * 1024)  # Read 20 * 128kb
>>> compressed = compress(input_data)
>>> decompressed = decompress(compressed) 
>>> decompressed == input_data
Out[6]: True