'Scapy won't recognize the upper layer when used alone (SOME/IP layer , SD layer)

I am working with SOME/IP protocol packets with UDP or TCP .The payload is SOME/IP content. In scapy there is no built-in layers for SOME/IP but someone has already implemented it on github . https://github.com/jamores/eth-scapy-someip

Here is the small explanation. There are two kinds of SOME/IP packets. 1.) base SOME/IP packets and 2.)SOME/IP-SD (Service Discovery) packets containing the base part and SD part.These two have been implemented as separate layers though they must be bound when building(please see the github sourcecode) .

Here is the problem . I am writing a python module that should be able to read a pcap file and filter SOME/IP base packets and SOME/IP-SD packets . However, when I extract and analyze each packet , only SOME/ID-SD packets are recognized (which contains SOME/IP layer and SOME/IP-SD layer)

from eth_scapy_someip.eth_scapy_sd import SD
from eth_scapy_someip.eth_scapy_someip import SOMEIP

In the following code, when I read a pcap file containing only some/ip base packets , the counter value is printed as 0. However when I read a pcap file containing only some/ip-sd packets , some/ip layer and some/ip-sd layer are automatically recognized by scapy .The counter value at the end is the same number of some/ip-sd packets.

counter = 0

for packet in PcapReader(file_name):
    if packet.haslayer(SOMEIP):
        counter +=1
    
print("the number of someip packets are :" , counter)


    

It seems that scapy internal mechanism as it is , is able to identify the some/ip layer only when sd layer also exist, not when the some/ip layer exists on its own.What do you think can be done to get SOME/IP layer when SD doesn't exist?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source