search

secdev / scapy

Scapy: the Python-based interactive packet manipulation program & library.
https://scapy.net
GNU General Public License v2.0
10.81k stars 2.03k forks source link

[Enhancement] Add Interpret field #3637

Open matsievskiysv opened 2 years ago

matsievskiysv commented 2 years ago

Brief description

ERPS standard (probably some others) interpret lower layer's data.

For example, R-APS messages encode ERPS ring ID into MAC address:

The R-APS messages will use the MAC address range allocated within the ITU organizationally unique identifier (OUI) for [ITU-T G.8032] R-APS communication. The last octet of the MAC address is designated as ring ID (01-19-A7-00-00-[Ring ID]). The default ring ID is 01.

While this information resides in the lower layers, its interpretation logically belongs to the current layer. Some kind of Interpret field is needed to represent such data properly. It could inspect lower layers for information on dissection and patch data on build.

Scapy version

any

Python version

any

Operating system

any

Additional environment information

No response

How to reproduce

-

Actual result

No response

Expected result

No response

Related resources

No response

gpotter2 commented 2 years ago

The currently expected way of doing this in Scapy is to create custom logic and use pkt.underlayer to access lower layers.

I fail to see what such a field should do :/

matsievskiysv commented 2 years ago

I fail to see what such a field should do :/

It would just display information in show functions and provide a convenient way of modifying underlayers.

gpotter2 commented 2 years ago

Oh I see what you mean, like Wireshark [additional info] fields. We could probably find a better name than Interpret :stuck_out_tongue: This could have some use, alghouth I'm unsure about whether we should call it a field or not.

douniwan5788 commented 1 month ago

It can be very useful to display whether a checksum field is correct or not