8000 Report the interface ID used to capture pcapng files by emarch06 · Pull Request #4729 · secdev/scapy · GitHub
[go: up one dir, main page]
Skip to content

Report the interface ID used to capture pcapng files #4729

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Report the interface ID used to capture pcapng files #4729

wants to merge 1 commit into from

Conversation

emarch06
Copy link
@emarch06 emarch06 commented Apr 25, 2025 •
edited
Loading
  • On pcapng files, you can have several capture interfaces. We report this information to be able to use it on another classes
    I don't think adding a unit test for this is worth it, since We just report a field to the upper layer that is already parsed.

Note: It's my first contribution to scapy. Let me know if I missed something :-)

Checklist:

  • If you are new to Scapy: I have checked CONTRIBUTING.md (esp. section submitting-pull-requests)
  • I squashed commits belonging together
  • I added unit tests or explained why they are not relevant
  • I executed the regression tests (using cd test && ./run_tests or tox)
  • If the PR is still not finished, please create a Draft Pull Request

fixes #4731

@emarch06 emarch06 force-pushed the emarch06/provide_interface_id branch from a18382f to ad116e9 Compare April 25, 2025 15:00
@gpotter2
Copy link
Member
gpotter2 commented May 4, 2025

Hi, thanks for the PR.
I don't really understand where you're getting those IDs from. Packets already have the interface they're sniffed on as parameter, isn't that enough?
Thanks

@emarch06
Copy link
Author
emarch06 commented May 5, 2025

Hi @gpotter2,

we'd like to use the interface ID of the pcapng in a wireshark-way
image

In the python code, it would be like this:

sniff(prn=self._scapy_callback, ....

def _scapy_callback(self, packet):
    eth_message.interface_id = packet.intid

In pcapng,
interface name is parsed from Interface Description Block (method: _read_block_idb)

Then, parsing the packets of the pcapng,
The Interface ID value refers to a particular Interface Description Block by referencing its implicit zero-indexed IDB position in the current section.
I.e. the first IDB defined in a section has Interface ID 0x00000000, the second one has 0x00000001, and so on.

we didn't find a way to get this information from a Packet instance.
Maybe I'm wrong and this patch is useless. In this case, could you explain me how to do this?

Thanks in advance

polybassa
polybassa reviewed May 13, 2025
View reviewed changes
scapy/utils.py
@@ -1952,6 +1955,7 @@ def _read_block_pkt(self, block, size):
self.endian + "HH4I",
block[:20],
)
ifname = self.interface_names[intid] if intid < len(self.interface_names) else None
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would suggest to use a

try:
...
except KeyError:
pass

here

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indeed, it's fixed. Thanks

@codecov Codecov
Copy link
codecov bot commented May 14, 2025 •
edited
Loading

Codecov Report

Attention: Patch coverage is 36.36364% with 7 lines in your changes missing coverage. Please review.

Project coverage is 49.31%. Comparing base (0648c0d) to head (ad116e9).

Files with missing lines Patch % Lines
scapy/utils.py 0.00% 5 Missing ⚠️
scapy/packet.py 66.66% 2 Missing ⚠️

❗ There is a different number of reports uploaded between BASE (0648c0d) and HEAD (ad116e9). Click for more details.

HEAD has 10 uploads less than BASE
Flag BASE (0648c0d) HEAD (ad116e9)
12 2
Additional details and impacted files 
@@             Coverage Diff             @@
##           master    #4729       +/-   ##
===========================================
- Coverage   82.20%   49.31%   -32.89%     
===========================================
  Files         361      343       -18     
  Lines       87195    86931      -264     
===========================================
- Hits        71679    42873    -28806     
- Misses      15516    44058    +28542
Files with missing lines Coverage Δ
scapy/packet.py 50.97% <66.66%> (-33.52%) ⬇️
scapy/utils.py 25.61% <0.00%> (-48.83%) ⬇️

... and 312 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Report the interface ID used to capture pcapng files
58b3bc8 
* On pcapng files, you can have several capture interfaces.
We report this information to be able to use it on another classes
@emarch06 emarch06 force-pushed the emarch06/provide_interface_id branch from ad116e9 to 58b3bc8 Compare May 14, 2025 07:55
gpotter2
gpotter2 reviewed May 28, 2025
View reviewed changes
Copy link
Member
@gpotter2 gpotter2 left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi. Sorry again for the delay of review. Thanks a lot for the PR and your interest in Scapy !

I understand your point, my only question was to know if sniffed_on didn't already fill that role by providing the interface name. At least that's what it's supposed to do.

Do you specifically need the interface ID for your application? I feel like it would be like storing the same information twice to include both the interface id and name in every packet.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@polybassa polybassa polybassa left review comments

@gpotter2 gpotter2 gpotter2 left review comments

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
needs additional info
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Make the interface ID used to capture pcapng files available
3 participants
@emarch06 @gpotter2 @polybassa
0