pyshark: access raw udp payload

Question

I'm new to pyshark. I'm trying to write a parser for custom UDP packets. I'm using the FileCapture object to read packets from a file.

>>> cap = pyshark.FileCapture('sample.pcap')
>>> pkt = cap.next()
>>> pkt
<UDP/DATA Packet>
>>> pkt.data.data
'01ca00040500a4700500a22a5af20f830000b3aa000110da5af20f7c000bde1a000006390000666e000067f900000ba7000026ce000001d00000000100001726000100000000000000000000000017260500a4700500a22a608600250500a8c10500a22a608601310500a8c10500a22b608601200500a8cc0500a22a6086000c'
>>> dir(pkt.udp)
['DATA_LAYER', '__class__', '__delattr__', '__dict__', '__dir__', '__doc__', '__format__', '__getattr__', '__getattribute__', '__getstate__', '__hash__', '__init__', '__module__', '__new__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__setstate__', '__sizeof__', '__str__', '__subclasshook__', '__weakref__', '_all_fields', '_field_prefix', '_get_all_field_lines', _get_all_fields_with_alternates', '_get_field_or_layer_repr', '_get_field_repr', '_layer_name', '_sanitize_field_name', 'checksum', 'checksum_status', 'dstport', 'field_names', 'get', 'get_field', 'get_field_by_showname', get_field_value', 'layer_name', 'length', 'port', 'pretty_print', raw_mode', 'srcport', 'stream']

I need a method to simply access the packet's UDP payload. The only method I found to access raw packet data is pkt.data.data, but this returns the entire content of the packet while I'm only interested to UDP portion. Something like pkt.udp.data. Is there a way to simply do that or I need to use pkt.data.data and calculate the offset at which my data are placed?

Answer 1

The only method I found to access raw packet data is pkt.data.data,

Correct.

but this returns the entire content of the packet while I'm only interested to UDP portion.

Incorrect. The .data.data attribute is a hex string representation of just the UDP payload itself.

For example if your UDP payload is the ASCII string "hello", you can simply retrieve it as such with: bytearray.fromhex(pkt.data.data).decode()

(You can easily test this yourself from a Bash console, e.g., with echo -n hello >/dev/udp/localhost/12345 while doing a pyshark capture on lo:12345.)

Answer 2

pyshark_parser might help you out: https://github.com/jlents/pyshark_parser/blob/master/pyshark_parser/

I was looking at their code and what you might be looking for here: https://github.com/jlents/pyshark_parser/blob/master/pyshark_parser/packet_util.py

def get_all_field_names(packet, layer=None):
'''
    Builds a unique list of field names, that exist in the packet,
    for the specified layer.
    If no layer is provided, all layers are considered.
    Args:
        packet: the pyshark packet object the fields will be gathered from
        layer: the string name of the layer that will be targeted
    Returns:
        a set containing all unique field names
        or None, if packet is None
'''

if not packet:
    return None

field_names = set()
for current_layer in packet.layers:
    if not layer or layer == current_layer.__dict__['_layer_name']:
        for field in current_layer.__dict__['_all_fields']:
            field_names.add(field)
return field_names

and

def get_value_from_packet_for_layer_field(packet, layer, field):
'''
    Gets the value from the packet for the specified 'layer' and 'field'
    Args:
        packet: The packet where you'll be retrieving the value from
        layer: The layer that contains the field
        field: The field that contains the value
    Returns:
        the value at packet[layer][key] or None
        or None, if any of the arguments are None
'''
if not packet or not layer or not field:
    return None
for current_layer in packet.layers:
    if layer == current_layer.__dict__['_layer_name'] and \
       current_layer.__dict__['_all_fields']:
        return current_layer.__dict__['_all_fields'][field]
return None