tthtlc / dpkt

Automatically exported from code.google.com/p/dpkt
Other
0 stars 0 forks source link

Setting TCP offset truncates TCP data field #108

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
-What steps will reproduce the problem?
import sys
import pcap
import ethernet
import tcp

if(len(sys.argv) > 2):
  pcIn = pcap.Reader(open(sys.argv[1]))
  pcOut = pcap.Writer(open(sys.argv[2], 'wb'))
  for ts, pkt in pcIn:
    eth = ethernet.Ethernet(pkt)
    ip = eth.data
    otcp = ip.data

    newTCP = tcp.TCP()
    newTCP.dport = otcp.dport
    newTCP.sport = otcp.sport
    newTCP.win = otcp.win
    newTCP.off = otcp.off
#    newTCP.off_x2 = otcp.off_x2
    newTCP.sum = otcp.sum
    newTCP.flags = otcp.flags
    newTCP.seq = otcp.seq
    newTCP.ack = otcp.ack
    newTCP.data = otcp.data

    ip.data = newTCP
    pcOut.writepkt(ethernet.Ethernet.pack(eth), ts)

-What is the expected output? What do you see instead?
I expect the above script will copy the TCP packets exactly.

-What version of the product are you using? On what operating system?
dpkt-1.7r88
Debian Linux Wheezy(7.0)
Python 2.7.3

-Please provide any additional information below.
Example source and corupted destination pcap files are attached.

It's quite possible I am simply not doing this correctly.  If so please tell me 
the correct way to calculate the TCP data offset.

Thanks,
Smutt

Original issue reported on code.google.com by sm...@depht.com on 22 May 2013 at 1:04

Attachments:

GoogleCodeExporter commented 9 years ago
Ignore this.  I just didn't understand I should be using TCP.off instead of 
TCP.off_x2.

Original comment by sm...@depht.com on 3 Jun 2013 at 4:27

GoogleCodeExporter commented 9 years ago
Closing this issue

Original comment by kbandla@in2void.com on 29 Dec 2014 at 5:06