lists in self.data and pprint-todo about dpkt HOT 2 CLOSED

I've seen a couple ways this has been done in dpkt parsers

1. auto-parse as much as possible, tls is an example;
2. don't parse everything, but provide routines and/or classes to pack and unpack things, netbios is an example, dhcp pack options is another one.

In both cases the remaining, unparsed data buffer goes to self.data, which can be picked up by the next protocol layer, or decoded as part of the same layer.

Choosing one method over the other is up the author of the code. In general though we try to keep dpkt fast and nimble, so a good guiding principle is to avoid parsing things if it impacts performance. A good example is IP and MAC addresses - they are present in most packets, so dpkt avoids converting them and leaves it up to the developer. pprint() will display printable IP and MAC addresses on demand.

As for naming fields, going by the protocol's RFC is a bulletproof way, but that's not always available. I've seen fields named pretty arbitrarily. In most cases when we refactor decoders and decide to rename fields, we leave the old ones around as well for compatibility. Example: https://github.com/kbandla/dpkt/blob/master/dpkt/ssl.py#L343

Hope this is helpful!

from dpkt.

Very much, thank you!

from dpkt.