Shulou(Shulou.com)05/31 Report--

This article introduces how to use scapy to parse the port of the data packet, the content is very detailed, interested friends can refer to, I hope it can be helpful to you.

I've been out all day today, and there's a power outage when I write a manuscript at night. Fuck.

To get back to the point, today, I used scapy to parse the packets I captured overnight yesterday, because in my experiment, the SOAP service uses port 8080, and you can see the specific number of the source port in the relevant lines with Wireshark, but wireshark cannot produce python data objects. Packets can only be parsed by scapy.

However, when I found the corresponding line, I found that the port was not a number, but a character "http-alt":

What on earth does that dport mean?

Later, you can query the port number represented by this character in / etc/services:

It is clear that the port number is 8080, which is the port of my SOAP application.

Why are these applications so sensitive to ports? Wireshark and Scapy are the same urine.

Add: when you use str () to turn dport into a string, it is automatically converted to a numeric port number instead of the string "http-alt"

On how to use scapy to parse packets when the port is shared here, I hope that the above content can be of some help to you, can learn more knowledge. If you think the article is good, you can share it for more people to see.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.