scapy.contrib.sebek

Sebek: kernel module for data collection on honeypots.

class scapy.contrib.sebek.SebekHead

Bases: scapy.packet.Packet

aliastypes
fields_desc
SebekHead fields

magic

XIntField

13684944

version

ShortField

1

type

ShortEnumField

0

counter

IntField

0

time_sec

IntField

0

time_usec

IntField

0

mysummary()
payload_guess

Possible sublayers: SebekV1, SebekV2Sock, SebekV2, SebekV3Sock, SebekV3

class scapy.contrib.sebek.SebekV1

Bases: scapy.packet.Packet

aliastypes
fields_desc
SebekV1 fields

pid

IntField

0

uid

IntField

0

fd

IntField

0

cmd

StrFixedLenField

b''

data_length

FieldLenField

None

data

StrLenField

b''

mysummary()
class scapy.contrib.sebek.SebekV2

Bases: scapy.contrib.sebek.SebekV3

aliastypes
fields_desc
SebekV2 fields

parent_pid

IntField

0

pid

IntField

0

uid

IntField

0

fd

IntField

0

inode

IntField

0

cmd

StrFixedLenField

b''

data_length

FieldLenField

None

data

StrLenField

b''

mysummary()
class scapy.contrib.sebek.SebekV2Sock

Bases: scapy.contrib.sebek.SebekV3Sock

aliastypes
fields_desc
SebekV2Sock fields

parent_pid

IntField

0

pid

IntField

0

uid

IntField

0

fd

IntField

0

inode

IntField

0

cmd

StrFixedLenField

b''

data_length

IntField

15

dip

IPField

'127.0.0.1'

dport

ShortField

0

sip

IPField

'127.0.0.1'

sport

ShortField

0

call

ShortEnumField

0

proto

ByteEnumField

0

mysummary()
class scapy.contrib.sebek.SebekV3

Bases: scapy.packet.Packet

aliastypes
fields_desc
SebekV3 fields

parent_pid

IntField

0

pid

IntField

0

uid

IntField

0

fd

IntField

0

inode

IntField

0

cmd

StrFixedLenField

b''

data_length

FieldLenField

None

data

StrLenField

b''

mysummary()
class scapy.contrib.sebek.SebekV3Sock

Bases: scapy.packet.Packet

aliastypes
fields_desc
SebekV3Sock fields

parent_pid

IntField

0

pid

IntField

0

uid

IntField

0

fd

IntField

0

inode

IntField

0

cmd

StrFixedLenField

b''

data_length

IntField

15

dip

IPField

'127.0.0.1'

dport

ShortField

0

sip

IPField

'127.0.0.1'

sport

ShortField

0

call

ShortEnumField

0

proto

ByteEnumField

0

mysummary()