'Scapy won't recognize the upper layer when used alone (SOME/IP layer , SD layer)
I am working with SOME/IP protocol packets with UDP or TCP .The payload is SOME/IP content. In scapy there is no built-in layers for SOME/IP but someone has already implemented it on github . https://github.com/jamores/eth-scapy-someip
Here is the small explanation. There are two kinds of SOME/IP packets. 1.) base SOME/IP packets and 2.)SOME/IP-SD (Service Discovery) packets containing the base part and SD part.These two have been implemented as separate layers though they must be bound when building(please see the github sourcecode) .
Here is the problem . I am writing a python module that should be able to read a pcap file and filter SOME/IP base packets and SOME/IP-SD packets . However, when I extract and analyze each packet , only SOME/ID-SD packets are recognized (which contains SOME/IP layer and SOME/IP-SD layer)
from eth_scapy_someip.eth_scapy_sd import SD
from eth_scapy_someip.eth_scapy_someip import SOMEIP
In the following code, when I read a pcap file containing only some/ip base packets , the counter value is printed as 0. However when I read a pcap file containing only some/ip-sd packets , some/ip layer and some/ip-sd layer are automatically recognized by scapy .The counter value at the end is the same number of some/ip-sd packets.
counter = 0
for packet in PcapReader(file_name):
if packet.haslayer(SOMEIP):
counter +=1
print("the number of someip packets are :" , counter)
It seems that scapy internal mechanism as it is , is able to identify the some/ip layer only when sd layer also exist, not when the some/ip layer exists on its own.What do you think can be done to get SOME/IP layer when SD doesn't exist?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
