1
  • Following is the snippet of my code.
  • It opens a pcap file called test.

File : https://easyupload.io/w81oc1

  • Edits a value called as QQIC.
  • Creates a new pcap file.
from scapy.all import *
from scapy.utils import rdpcap
from scapy.utils import wrpcap
import scapy.contrib.igmpv3

#Read the pcap file    
pkt = rdpcap("test.pcap")


#Edit the value of qqic    
pkt[0]['IGMPv3mq'].qqic = 30

# Writ it to the pcap file.
#wrpcap("final.pcap",pkt)
  • All this works fine.
  • However, when I check the pcap, I get an error stating that the checksum is invalid.

PCAP

  • Cant figure out a way to re compute the check sum.
Neil Roy
  • 17
  • 5

1 Answers1

1

When you edit a packet (particularly an explicit packet, that is, a packet that has been read from a PCAP file or a network capture) in Scapy, you have to "delete" the fields that need to be computed again (checksum fields as here, but also sometimes length fields). For that, you can use the del statement:

from scapy.all import *
load_contrib("igmpv3")

# Read the pcap file    
pkt = rdpcap("test.pcap")

# Edit the value of qqic    
pkt[0]['IGMPv3mq'].qqic = 30

# Force Scapy to compute the IGMP checksum
# XXX the important line is here XXX
del pkt[0][IGMPv3].chksum

# Write it to the pcap file.
wrpcap("final.pcap", pkt)

I have also simplified the imports.

Pierre
  • 6,047
  • 1
  • 30
  • 49