dpkt包官方文档解析汉化----HTTP Request Example(tcp层[tcp.data携带者http头部请求等信息]

dpkt包官方文档解析汉化----HTTP Request Example(tcp层[tcp.data携带者http头部请求等信息]

Print HTTP Requests Example (打印HTTP请求示例)

This example expands on the print_packets example. It checks for HTTP request headers and displays their contents.

(这个例子扩展了print_packages的例子。它检查HTTP请求头并显示它们的内容。)

NOTE: We are not reconstructing ‘flows’ so the request (and response if you tried to parse it) will only parse correctly if they fit within a single packet. Requests can often fit in a single packet but Responses almost never will. For proper reconstruction of flows you may want to look at other projects that use DPKT (http://chains.readthedocs.io and others)

(注意:我们没有重新构造“流”，因此请求(如果您试图解析它，那么响应)只有在符合单个包的情况下才会正确解析。请求通常可以放在一个包中，但是响应几乎永远不会。要正确地重构流，您可能需要查看使用DPKT的其他项目(http://chains.readthedocs)。io和其他人))

Code Excerpt (代码摘录)

# For each packet in the pcap process the contents  对pcap中的每个包处理内容
for timestamp, buf in pcap:

    # Unpack the Ethernet frame (mac src/dst, ethertype) 
    #解压以太网帧(mac src/dst, ethertype)
    eth = dpkt.ethernet.Ethernet(buf)

    # Make sure the Ethernet data contains an IP packet
    #确保以太网数据包含一个IP包
    if not isinstance(eth.data, dpkt.ip.IP):
        print 'Non IP Packet type not supported %s\n' % eth.data.__class__.__name__
        continue

    # Now grab the data within the Ethernet frame (the IP packet)
    ip = eth.data

    # Check for TCP in the transport layer
    #现在获取以太网帧(IP包)中的数据
    if isinstance(ip.data, dpkt.tcp.TCP):

        # Set the TCP data
        tcp = ip.data

        # Now see if we can parse the contents as a HTTP request
        # 现在看看是否可以将内容解析为HTTP请求
        try:
            request = dpkt.http.Request(tcp.data)
        except (dpkt.dpkt.NeedData, dpkt.dpkt.UnpackError):
            continue

        # Pull out fragment information (flags and offset all packed into off field, so use bitmasks)
        #提取片段信息(标记和偏移量都打包到off字段中，所以使用位掩码)
        do_not_fragment = bool(ip.off & dpkt.ip.IP_DF)
        more_fragments = bool(ip.off & dpkt.ip.IP_MF)
        fragment_offset = ip.off & dpkt.ip.IP_OFFMASK

        # Print out the info 打印出信息
        print 'Timestamp: ', str(datetime.datetime.utcfromtimestamp(timestamp))
        print 'Ethernet Frame: ', mac_addr(eth.src), mac_addr(eth.dst), eth.type
        print 'IP: %s -> %s   (len=%d ttl=%d DF=%d MF=%d offset=%d)' % \
              (inet_to_str(ip.src), inet_to_str(ip.dst), ip.len, ip.ttl, do_not_fragment, more_fragments, fragment_offset)
        print 'HTTP request: %s\n' % repr(request)

Example Output

Timestamp:  2004-05-13 10:17:08.222534
Ethernet Frame:  00:00:01:00:00:00 fe:ff:20:00:01:00 2048
IP: 145.254.160.237 -> 65.208.228.223   (len=519 ttl=128 DF=1 MF=0 offset=0)
HTTP request: Request(body='', uri='/download.html', headers={'accept-language': 'en-us,en;q=0.5', 'accept-encoding': 'gzip,deflate', 'connection': 'keep-alive', 'keep-alive': '300', 'accept': 'text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,image/jpeg,image/gif;q=0.2,*/*;q=0.1', 'user-agent': 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113', 'accept-charset': 'ISO-8859-1,utf-8;q=0.7,*;q=0.7', 'host': 'www.ethereal.com', 'referer': 'http://www.ethereal.com/development.html'}, version='1.1', data='', method='GET')

Timestamp:  2004-05-13 10:17:10.295515
Ethernet Frame:  00:00:01:00:00:00 fe:ff:20:00:01:00 2048
IP: 145.254.160.237 -> 216.239.59.99   (len=761 ttl=128 DF=1 MF=0 offset=0)
HTTP request: Request(body='', uri='/pagead/ads?client=ca-pub-2309191948673629&random=1084443430285&lmt=1082467020&format=468x60_as&output=html&url=http%3A%2F%2Fwww.ethereal.com%2Fdownload.html&color_bg=FFFFFF&color_text=333333&color_link=000000&color_url=666633&color_border=666633', headers={'accept-language': 'en-us,en;q=0.5', 'accept-encoding': 'gzip,deflate', 'connection': 'keep-alive', 'keep-alive': '300', 'accept': 'text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,image/jpeg,image/gif;q=0.2,*/*;q=0.1', 'user-agent': 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113', 'accept-charset': 'ISO-8859-1,utf-8;q=0.7,*;q=0.7', 'host': 'pagead2.googlesyndication.com', 'referer': 'http://www.ethereal.com/download.html'}, version='1.1', data='', method='GET')

...

dpkt/examples/print_http_requests.py(http requests.py dpkt /例子/打印)

This example expands on the print_packets example. It checks for HTTP request headers and displays their contents. NOTE: We are not reconstructing ‘flows’ so the request (and response if you tried to parse it) will only

(这个例子扩展了print_packages的例子。它检查HTTP请求头并显示它们的内容。注意:我们没有重构“流”)

parse correctly if they fit within a single packet. Requests can often fit in a single packet but Responses almost never will. For proper reconstruction of flows you may want to look at other projects that use DPKT (http://chains.readthedocs.io and others)

(如果它们适合一个包，则正确解析。请求通常可以放在一个包中，但是响应几乎永远不会。要正确地重构流，您可能需要查看使用DPKT的其他项目(http://chains.readthedocs)。io和其他人))

examples.print_http_requests.mac_addr(address)

#Convert a MAC address to a readable/printable string(将MAC地址转换为可读/可打印的字符串)

examples.print_http_requests.inet_to_str(inet)

#Convert inet object to a string(将inet对象转换为字符串)

examples.print_http_requests.print_http_requests(pcap)

#Print out information about each packet in a pcap(在pcap中打印出每个数据包的信息)

examples.print_http_requests.test()
#Open up a test pcap file and print out the packets(打开一个测试pcap文件并打印出数据包)

以上方法具体实现源文档中方法后有链接实例

总结:

IP TCP HTTP 包含关系

  ip addres
      |
|IP Header |   DATA     | 
               ______
                  |
             |  TCP Header  |  TCP DATA |
                _______        _________
                   |                 |
                 port             ( HTTP 头部 )
                                    _________
                                         |
                                      host, GET post(负载)等请求