Question

我正在尝试使用dpkt和pcapy来监听接口上的HTTP响应

import dpkt
import pcapy

cap = pcapy.open_live('eth0',10000,1,0)

(header,payload) = cap.next()

while header:
    packet = dpkt.ethernet.Ethernet(str(payload))
    if str(packet.data.data.data).startswith('HTTP'):
        h = dpkt.http.Response(str(packet.data.data.data))
    (header,payload) = cap.next()

当我运行它时，它会读取第一个数据包。但是对于第二个数据包，它最终会读取错误的content-length值。例外是：

cona@vm-02:~$ sudo python cache-pcapy.py
Value of N 160 value of body 160
Value of N 5965717 value of body 1193
Traceback (most recent call last):
  File "cache-pcapy.py", line 12, in <module>
    h = dpkt.http.Response(str(packet.data.data.data))
  File "/usr/local/lib/python2.7/dist-packages/dpkt/http.py", line 76, in __init__
    self.unpack(args[0])
  File "/usr/local/lib/python2.7/dist-packages/dpkt/http.py", line 159, in unpack
    Message.unpack(self, f.read())
  File "/usr/local/lib/python2.7/dist-packages/dpkt/http.py", line 90, in unpack
    self.body = parse_body(f, self.headers)
  File "/usr/local/lib/python2.7/dist-packages/dpkt/http.py", line 59, in parse_body
    raise dpkt.NeedData('short body (missing %d bytes)' % (n - len(body)))
dpkt.dpkt.NeedData: short body (missing 5964524 bytes)

N值和身体长度的打印件来自http.py dpkt，其中我添加了此内容：

elif 'content-length' in headers:
        n = int(headers['content-length'])
        body = f.read(n)
        print 'Value of N {} value of body {}'.format(n,len(body))
        if len(body) != n:

            raise dpkt.NeedData('short body (missing %d bytes)' % (n - len(body)))

似乎错误的字节被读取为content-length。为什么会这样？

使用python捕获数据包

0 个答案: