mike01
commented
6 years ago The pasted bytes seem to belong to a platintext HTTP packet, new master version contains fixes.
Closed RadionBik closed 6 years ago
mike01
commented
6 years ago The pasted bytes seem to belong to a platintext HTTP packet, new master version contains fixes.
RadionBik
commented
6 years ago Thank you for the fast reply! Unfortunately, the error remains exactly in the same form, although, probably, for a different packet. Could you, please, check the library against the dump? the link is the following: https://yadi.sk/d/p-ylrJSp3ToLAd
mike01
commented
6 years ago Most of the packets are fragmented TCP segments. You need complete packet bytes to create the SSL packets, pypacker can't recreate them from nothing.
RadionBik
commented
6 years ago So, I captured a trace in a completely different network with a different device, but I ran into the error again! Am I the only person who has faced it? :) The code is different now:
import re, dpkt, pcap
import pandas as ps
import numpy as np
import sklearn
import socket
from pypacker import ppcap
from pypacker.layer12 import ethernet
from pypacker.layer3 import ip
from pypacker.layer4 import tcp,udp
def parseVoIPpacker(pcapfile,ipOfInterest,portsOfInterest):
for ts, raw in ppcap.Reader(filename=pcapfile):
eth = ethernet.Ethernet(raw)
#create the keys for IP UDP/TCP flows
if eth[ip.IP] is not None:
if eth[udp.UDP] is not None:
if ((eth.ip.src_s in ipOfInterest) or (eth.ip.dst_s in ipOfInterest)): #and ((eth.ip.udp.sport in portsOfInterest) or (eth.ip.udp.dport in portsOfInterest)):
#if ((eth.ip.udp.sport in portsOfInterest) or (eth.ip.udp.dport in portsOfInterest)):
key = (ts,'udp', frozenset(((eth.ip.src_s, eth.ip.udp.sport),(eth.ip.dst_s, eth.ip.udp.dport))))
print(key)
else:
continue
pcapfile = '../voiceTraces/wpNormalCall.pcap'
ipOfInterest = ['31.13.72.49', '176.59.109.149']
portsOfInterest = [45015,50787]
parseVoIPpacker(pcapfile,ipOfInterest,portsOfInterest)Take a look at the commented condition (the one checking port numbers): as soon as I activate it, the error occurs again.
The trace is about 1MB and available via the link: https://yadi.sk/d/406rOCIL3U49zR
I want to emphasize that dpkt works flawlessly. I wonder what can be wrong here, taking into account that only UDP packets are being processed in the code.
mike01
commented
6 years ago So to make it clear: you are talking about this type of error (e.g. appearing when parsing packet No. 3)?
ERROR (__init__): could not dissect in SSL: error('unpack requires a bytes object of length 2',)
Traceback (most recent call last):
File "/usr/lib/python3.4/site-packages/pypacker-4.0-py3.4.egg/pypacker/pypacker.py", line 169, in __init__
header_len = self._dissect(args[0])
File "/usr/lib/python3.4/site-packages/pypacker-4.0-py3.4.egg/pypacker/layer4/ssl.py", line 146, in _dissect
record_len = unpack_H(buf[offset + 3: offset + 5])[0]
struct.error: unpack requires a bytes object of length 2yes, I meant exactly this error, although for a different packet number.
mike01
commented
6 years ago That's exactly what I was talking about: Pypacker outputs warnings if it has problems dissecting bytes. You're trying to create a packet from incomplete packet bytes eg packet No. 3. Packet No. 3 is a TCP segment of a larger SSL stream spannning over multiple packets. Pypacker tries to dissect the bytes assuming it's a complete SSL packet, which it isn't. This leads to the errors (messages) you are seeing but you can access all values in the packet after all. In fact you can even access the non-dissectable bytes via body_bytes eg. eth.ip.tcp.body_bytes (assuming ip and tcp layers are present). Regarding dpkt: I can't see where it's parsing SSL/TLS (or any other application layer data above TCP) so I assume it gives a sh§% about it (see dpkt -> tcp.py). I've removed the warning outputs in the newest master commit, seems to be too confusing (;
mike01
commented
6 years ago Closing due response timeout
When I am trying to read packets from a pcap. file and convert them with ethernet.Ethernet() I am running into the following error:
And the same code in ipython3 gives the following:
ValueError: not enough values to unpack (expected 2, got 1)The code is as follows:
The pcap file is available via the link: https://yadi.sk/d/p-ylrJSp3ToLAd
update: the binary form of a packet the error is being thrown from:
Although dpkt seem to process it correctly.