TCP Ports in dpkt.tcp.TCP seem to have the wrong values about dpkt HOT 3 CLOSED

From [email protected] on July 27, 2007 15:14:53

Could you post the dump file you're processing (or an de-sensitized one that
reproduces what you're seeing)?

Also, you should take a look at the Reader class in dpkt's pcap.py. It provides a
convenient interface for reading in pcap files.

from dpkt.

From [email protected] on July 27, 2007 15:28:06

...or I could just take a minute to read your posted code. ;-)

I've never used pcapy, but as it is a pcap library I'm assuming it hands you the raw
packet from the pcap dump which includes the appropriate link and network layers, not
just the transport layer (TCP).

So try the following:

for i in pcap_dumps[key]:
    print `Ethernet(i[1])`
    \#packet_data[key].append(TCP(i[1]))

If the TCP port listed in the output looks correct, then that's your problem.

from dpkt.

From [email protected] on July 27, 2007 16:02:29

closing as invalid...

Status: Invalid

from dpkt.