search

GTiroadkill / dpkt

Automatically exported from code.google.com/p/dpkt
Other
0 stars 0 forks source link

No PPI Support #45

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
What steps will reproduce the problem?
1. Get a PCAP with PPI info (e.g., in Kismet)
2. Try to open it using dpkt with the code on http://www.jjguy.com/pcaputils/

What is the expected output? What do you see instead?
I see:
Traceback (most recent call last):
  File "parser2.py", line 4, in <module>
    pcapReader = dpkt.pcap.Reader(file(sys.argv[1], "rb"))
  File "/usr/lib/pymodules/python2.6/dpkt/pcap.py", line 105, in __init__
    self.dloff = dltoff[self.__fh.linktype]
KeyError: 192

What version of the product are you using? On what operating system?
1.6+svn54-1 on Ubuntu 10.04

Please provide any additional information below.
http://nmap.org/svn/libpcap/pcap-common.c defines 'LINKTYPE_PPI' as '192'.
http://www.cacetech.com/documents/PPI%20Header%20format%201.0.9.pdf provides 
PPI spec.

NOTE: even if it isn't worth it to support PPI may I sugest a better error 
message for it than an exception?

Original issue reported on code.google.com by pedrogfr...@gmail.com on 17 Aug 2010 at 5:00

GoogleCodeExporter commented 9 years ago 
Also as a nicer way to fail, it can suggest using tool 'wlan2eth' described on 
http://www.securityfocus.com/archive/137/506588/30/60/threaded to strip the PPI 
headers (the wlan2eth's actual homepage is 
http://www.willhackforsushi.com/?page_id=79 ) before exiting with an error.

Original comment by pedrogfr...@gmail.com on 23 Aug 2010 at 3:56