10

With scapy we can to this :

p = Ether() / IP()

What kind of operation does '/' really do ? What kind of object does it return ? If I type p in a python interpreter it returns this

<Ether  ... | IP ...>

What does '|' mean in this case ?

I was trying to change the field dst of IP after creating p without recreating the object entirely, but I didn't manage to do it as I don't know what kind of object I am facing.

Thank you.

x4rkz
  • 513
  • 4
  • 19

1 Answers1

8

The div / operator is used in Scapy to stack layers:

The / operator has been used as a composition operator between two layers. When doing so, the lower layer can have one or more of its defaults fields overloaded according to the upper layer.

The | in your printing output is just a text separator to help you distinguish between stacked layers.

Assem
  • 11,574
  • 5
  • 59
  • 97
  • Thank you, I have seen the operator in a socket library in C++. Is this scapy's own feature, or is it available more generally in python ? Is this used for anything else than sockets for instance ? – x4rkz Jan 16 '16 at 22:08
  • 1
    @x4rkz Scapy made it unique to choose to overide the div operaotr, other libraries prefer to override `|` operator. – Assem Jan 16 '16 at 22:12
  • Okay, but I mean the general layer feature, is it specific to scapy ? Did scapy implemented a totally new feature, or does there exist a more primitive layer feature in python which scapy improved ? – x4rkz Jan 16 '16 at 22:17
  • In Python the behavior of all operators can be customized per class. Many libraries and framework make use of this to offer convenient ways to combine objects. – Klaus D. Jan 17 '16 at 05:24
  • new link to stacking layers - https://scapy.readthedocs.io/en/latest/usage.html#stacking-layers – Barmaley Apr 14 '20 at 17:50
  • Can you please explain more, simpler ? I couldn't understand. What do you mean by "the lower layer can have one or more of its defaults fields overloaded according to the upper layer." ? @Assem – sfrhata Mar 17 '23 at 15:23