scapy.layers.ppi module

CACE Per-Packet Information (PPI) header.

A method for adding metadata to link-layer packets.

For example, one can tag an 802.11 packet with GPS co-ordinates of where it was captured, and include it in the PCAP file.

New PPI types should:

  • Make their packet a subclass of PPI_Element
  • Call bind_layers(PPI_Hdr, ExamplePPI, pfh_type=0xffff)

See layers/contrib/ for an example.

class scapy.layers.ppi.PPI

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.ppi.PPI'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (PPI).version>, <Field (PPI).flags>, <Field (PPI).len>, <Field (PPI).dlt>, <Field (PPI).headers>]

DEV: Guesses the next payload class from layer bonds. Can be overloaded to use a different mechanism.

Parameters:payload (str) – the layer’s payload
Returns:the payload class
class scapy.layers.ppi.PPI_Element

Bases: scapy.packet.Packet

Superclass for all PPI types.

aliastypes = [<class 'scapy.layers.ppi.PPI_Element'>, <class 'scapy.packet.Packet'>]

DEV: to be overloaded to extract current layer’s padding.

Parameters:s (str) – the current layer
Returns:a couple of strings (actual layer, padding)
static length_from(pkt)
class scapy.layers.ppi.PPI_Hdr

Bases: scapy.packet.Packet

aliastypes = [<class 'scapy.layers.ppi.PPI_Hdr'>, <class 'scapy.packet.Packet'>]
fields_desc = [<Field (PPI_Hdr).pfh_type>, <Field (PPI_Hdr).pfh_length>]

DEV: can be overloaded to return a string that summarizes the layer. Only one mysummary() is used in a whole packet summary: the one of the upper layer, # noqa: E501 except if a mysummary() also returns (as a couple) a list of layers whose # noqa: E501 mysummary() must be called if they are present.

payload_guess = [({'pfh_type': 30006}, <class 'scapy.layers.bluetooth4LE.BTLE_PPI'>), ({'pfh_type': 2}, <class 'scapy.contrib.ppi_cace.PPI_Dot11Common'>), ({'pfh_type': 30002}, <class 'scapy.contrib.ppi_geotag.PPI_Geotag_GPS'>), ({'pfh_type': 30003}, <class 'scapy.contrib.ppi_geotag.PPI_Geotag_Vector'>), ({'pfh_type': 30004}, <class 'scapy.contrib.ppi_geotag.PPI_Geotag_Sensor'>), ({'pfh_type': 30005}, <class 'scapy.contrib.ppi_geotag.PPI_Geotag_Antenna'>)]