In Scapy/Kamene python, how do I find the global headers for a pcap file?

Question

So in C, while reading from a Pcap file, you can use the C libpcap library to get all this information related to the global headers:

typedef struct pcap_hdr_s {
        guint32 magic_number;   /* magic number */
        guint16 version_major;  /* major version number */
        guint16 version_minor;  /* minor version number */
        gint32  thiszone;       /* GMT to local correction */
        guint32 sigfigs;        /* accuracy of timestamps */
        guint32 snaplen;        /* max length of captured packets, in octets */
        guint32 network;        /* data link type */
} pcap_hdr_t;

So I've searched for a long time to no avail in how to find these variables in python libraries Scapy/Kamene.

Can somebody please show me sample code from the Scapy/Kamene that'll help me find all these variables or at least a way to find all these variables??

Answer 1

This isn't possible in Scapy as of the time of this writing. You can still do this with python though by reading it as a struct of bytes:

import struct

LITTLE_ENDIAN = "<"
BIG_ENDIAN = ">"

with open("temp.pcap", "rb") as f:
    filebytes = f.read()
if filebytes[:2] == b"\xa1\xb2":
    endianness = BIG_ENDIAN
elif filebytes[:2] == b"\xd4\xc3":
    endianness = LITTLE_ENDIAN
# pcapng is a completely different filetype and has different headers
# It's magic number is also the same between big/little endian
elif filebytes[:2] == b"\n\r":
    raise ValueError("This capture is a pcapng file (expected pcap).")
else:
    raise ValueError("This capture is the wrong filetype (expected pcap.")

# Endianness is < or > and is handled by checking magic number.
pcap_headers = struct.unpack(endianness + "IHHIIII", filebytes[:24])
print(pcap_headers)
---
(2712847316, 2, 4, 0, 0, 524288, 1)

Here, we unpack with < for little-endian on my macos system (> for big-endian). H reads 4 bytes, while I reads 2 bytes. You can read more about format characters in the Python3 struct documentation. We can check the magic number easily:

>>> int(str("A1B2C3D4"), 16)
2712847316

It looks like this is indeed a pcap with the correct magic number. For magic number byte order shenanigans, take a look at this SO answer (there can be multiple correct pcap "magic numbers").

Thanks to @Cukic0d: scapy source code is a great place to look at parsing pcap magic numbers.