通过scapy,当手动编辑数据包时,自动更新数据包TCP序列并确认数字和IP层长度

2024-10-03 11:12:26 发布

您现在位置:Python中文网/ 问答频道 /正文

我正在从pcap文件读取数据包,并在TCP负载中插入一些唯一的id,因此需要更新IP层长度、TCP序列和确认号。有可能由斯卡皮来做这件事吗

for pkt in pkt_reader_pcap:

    if IP not in pkt:
        continue

    if TCP not in pkt:
        continue

    newp = pkt.payload
    newp[IP].dst = 1.2.3.4
    newp[IP].src = 1.2.3.4
    del newp[IP].len
    del newp[IP].chksum

    # if pkt has TCP layer, insert field before Host to the payload
    field = "Id: 1234\r\n"

    insert = field + 'Host: '
    http_content = newp.getlayer(Raw).load
    http_content = http_content.replace(b"Host: ", insert.encode())
    newp[Raw].load = http_content
    newp[TCP].chksum = None

    ## manually updated length of IP header which works fine, but it should happen 
    ## automatically or by some method of scapy
    newp[IP].len += len(field)

我将TCP/IP校验和设置为None,但Seq/Ack编号仍然没有更新。有没有办法达到同样的效果


Tags: iniphttphostfieldlenifnot