如何从原始字节创建Scapy数据包

Question

使用python数据包解析/嗅探工具Scapy，我想从原始字节串创建一个数据包。虽然我的具体使用情况的细节更加真实，下面的例子说明我的问题，我现在的尝试：

# Get an example packet (we won't really have an offline file in production.) 
pkt = sniff(offline="./example_packets/example_packets2.pcap") 

# Convert it to raw bytes -- oddly __str__ does this. 
raw_packet = str(pkt) 

# Current, broken, attempt to construct a new packet from the same bytes as the old. 
# In truth, there are easier ways to copy packets from existing Scapy packets, but 
# we are really just using that offline packet as a convenient example. 
new_packet = Packet(_pkt=raw_packet) 

# Sadly, while this packet has the bytes internally, it no longer has the 
# interpretations of the layers like the original packet did (such as saying that 
# the packet is ARP and has these field values, etc. 
print repr(new_packet) 

我怎么能生产出从上看起来一样的原始字节的new_packet就好像闻从一个pcap文件？

Answer 1

Scapy无法猜测数据包的第一层，因此您需要指定它。

您可以使用相应的Packet子类来实现。例如，假设您的数据包的第一层是以太网，请使用Ether(raw_packet)而不是Packet(raw_packet)。