Skip to content

Report the interface ID used to capture pcapng files #4729

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

emarch06
Copy link

@emarch06 emarch06 commented Apr 25, 2025

  • On pcapng files, you can have several capture interfaces. We report this information to be able to use it on another classes
    I don't think adding a unit test for this is worth it, since We just report a field to the upper layer that is already parsed.

Note: It's my first contribution to scapy. Let me know if I missed something :-)

Checklist:

  • If you are new to Scapy: I have checked CONTRIBUTING.md (esp. section submitting-pull-requests)
  • I squashed commits belonging together
  • I added unit tests or explained why they are not relevant
  • I executed the regression tests (using cd test && ./run_tests or tox)
  • If the PR is still not finished, please create a Draft Pull Request

fixes #4731

* On pcapng files, you can have several capture interfaces.
We report this information to be able to use it on another classes
@emarch06 emarch06 force-pushed the emarch06/provide_interface_id branch from a18382f to ad116e9 Compare April 25, 2025 15:00
@gpotter2
Copy link
Member

gpotter2 commented May 4, 2025

Hi, thanks for the PR.
I don't really understand where you're getting those IDs from. Packets already have the interface they're sniffed on as parameter, isn't that enough?
Thanks

@emarch06
Copy link
Author

emarch06 commented May 5, 2025

Hi @gpotter2,

we'd like to use the interface ID of the pcapng in a wireshark-way
image

In the python code, it would be like this:

sniff(prn=self._scapy_callback, ....

def _scapy_callback(self, packet):
    eth_message.interface_id = packet.intid

In pcapng,
interface name is parsed from Interface Description Block (method: _read_block_idb)

Then, parsing the packets of the pcapng,
The Interface ID value refers to a particular Interface Description Block by referencing its implicit zero-indexed IDB position in the current section.
I.e. the first IDB defined in a section has Interface ID 0x00000000, the second one has 0x00000001, and so on.

we didn't find a way to get this information from a Packet instance.
Maybe I'm wrong and this patch is useless. In this case, could you explain me how to do this?

Thanks in advance

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Make the interface ID used to capture pcapng files available
2 participants