Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

haslayer() on xp return false and packet with large HTTP data and mapping http request/response #37

Open
tianxiawuzhe opened this issue Apr 10, 2018 · 0 comments

Comments

@tianxiawuzhe
Copy link

Using python3.4 and latest scapy-matster.
When I try to cap HTTP data with scapy_http's HTTPRequest/HTTPResponse, i found :

using packet.haslayer(HTTPRequest), return False on winxp sp3, but on Windows 7 is True.

could not cap with large HTTP data, when trying cap large post request, it will:
Detail : Traceback (most recent call last):
File "HelloWorld.py", line 185, in pkt_parser
File "site-packages\scapy\packet.py", line 1230, in decode_payload_as
File "site-packages\scapy\base_classes.py", line 239, in call
File "site-packages\scapy\packet.py", line 134, in init
File "site-packages\scapy\packet.py", line 755, in dissect
File "site-packages\scapy_http\http.py", line 150, in do_dissect
ValueError: need more than 1 value to unpack
I cap this data with wireshark, it shows one request has two segments,
Thus, i want to know sniff's prn function, whether the packet has the total datas or a piece of datas?
And how can i assemble all piece of HTTP datas ?

how can i match a HTTPRequest packet and a HTTPResponse packet? request/response packet may not be req-resp-req-resp, may by req-req-req-resp-resp-resp.

Many thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants
@tianxiawuzhe and others