TCP Ports in dpkt.tcp.TCP seem to have the wrong values

[kbandla]

From demonic....@gmail.com on July 27, 2007 17:41:58

What steps will reproduce the problem? 1. Load up an off line pcap (I am using Core Security's Pcapy)
2. Instantiate a tcp packet object with dpkt.tcp.TCP(packet_data)
3. Print sport dport, and it is wrong What is the expected output? What do you see instead? In the packet capture data I had I was expecting the value to 2001, which
would have been the server port connecting too and from. The dsport is
also incorrect. What version of the product are you using? On what operating system? I am using the latest from the repository and the operating system is
linux. Please provide any additional information below. I tried to debug the issue, but I have not been able to identify the
problem as of yet.

Attachment: process_pcap_files.py

Original issue: http://code.google.com/p/dpkt/issues/detail?id=5

[kbandla]

From jon.ober...@gmail.com on July 27, 2007 15:14:53

Could you post the dump file you're processing (or an de-sensitized one that
reproduces what you're seeing)?

Also, you should take a look at the Reader class in dpkt's pcap.py. It provides a
convenient interface for reading in pcap files.

[kbandla]

From jon.ober...@gmail.com on July 27, 2007 15:28:06

...or I could just take a minute to read your posted code. ;-)

I've never used pcapy, but as it is a pcap library I'm assuming it hands you the raw
packet from the pcap dump which includes the appropriate link and network layers, not
just the transport layer (TCP).

So try the following:

for i in pcap_dumps[key]:
    print `Ethernet(i[1])`
    \#packet_data[key].append(TCP(i[1]))

If the TCP port listed in the output looks correct, then that's your problem.

[kbandla]

From jon.ober...@gmail.com on July 27, 2007 16:02:29

closing as invalid...

Status: Invalid