<p>这是一个简单的ERF记录解析器,它每包返回一个dict(我只是把它组合在一起,所以没有经过很好的测试)。不是所有的标志字段都被解码,但是那些没有被解码的字段并不广泛适用):</p>
<p>注意:</p>
<ul>
<li>ERF记录类型:1=HDLC,2=以太网,3=ATM,4=重新组装的AAL5,5-7个多通道变体,此处不处理额外的报头。在</li>
<li>^如果快照长度太短,{<cd1>}可以小于<code>wlen+len(header)</code>。在</li>
<li>间隙丢失计数器是指当Dag数据包处理器的输入队列溢出时,在该数据包和之前捕获的数据包之间丢失的数据包数。在</li>
<li>如果你不想用scapy,就把这两行注释掉。在</li>
</ul>
<p>代码:</p>
<pre><code>import scapy.layers.all as sl
def erf_records( f ):
"""
Generator which parses ERF records from file-like ``f``
"""
while True:
# The ERF header is fixed length 16 bytes
hdr = f.read( 16 )
if hdr:
rec = {}
# The timestamp is in Intel byte-order
rec['ts'] = struct.unpack( '<Q', hdr[:8] )[0]
# The rest is in network byte-order
rec.update( zip( ('type', # ERF record type
'flags', # Raw flags bit field
'rlen', # Length of entire record
'lctr', # Interstitial loss counter
'wlen'), # Length of packet on wire
struct.unpack( '>BBHHH', hdr[8:] ) ) )
rec['iface'] = rec['flags'] & 0x03
rec['rx_err'] = rec['flags'] & 0x10 != 0
rec['pkt'] = f.read( rec['rlen'] - 16 )
if rec['type'] == 2:
# ERF Ethernet has an extra two bytes of pad between ERF header
# and beginning of MAC header so that IP-layer data are DWORD
# aligned. From memory, none of the other types have pad.
rec['pkt'] = rec['pkt'][2:]
rec['pkt'] = sl.Ether( rec['pkt'] )
yield rec
else:
return
</code></pre>