Module eco.packet
Packet encoding and decoding helpers.
This module provides:
- decoders for common L2/L3/L4 packets (Ethernet, IPv4/IPv6, ARP, ICMP, TCP, UDP, and selected 802.11 radiotap frames)
- encoders for raw packets used with raw sockets
Most from_* functions return a packet object that supports pkt:next() to
decode the next protocol layer.
Functions
| from_icmp (data) | Decode a raw ICMP packet. |
| from_icmp6 (data) | Decode a raw ICMPv6 packet. |
| from_ip (data) | Decode a raw IPv4 packet. |
| from_ip6 (data) | Decode a raw IPv6 packet. |
| from_ether (data) | Decode an Ethernet frame. |
| from_radiotap (data) | Decode an IEEE 802.11 frame from a radiotap packet. |
| icmp (typ, code, id, sequence[, data=""[, checksum=false]]) | Build an ICMP echo or echo-reply packet. |
| icmp6 (typ, code, id, sequence[, data=""[, checksum=false]]) | Build an ICMPv6 echo request or echo reply packet. |
| udp (source, dest[, data=""[, saddr[, daddr]]]) | Build a UDP packet. |
| tcp (source, dest, seq, ack_seq[, flags[, window=false[, saddr=false[, daddr=false[, data=false]]]]]) | Build a TCP packet (without options). |
| ip (saddr, daddr, protocol[, data=""]) | Build an IPv4 packet. |
| arp (op[, sha="00:00:00:00:00:00"[, sip="0.0.0.0"[, tha="00:00:00:00:00:00"[, tip="0.0.0.0"]]]]) | Build an ARP packet. |
| ether (source, dest, proto[, data=""]) | Build an Ethernet frame. |
Class ParsedPacket
| ParsedPacket:next () | Decode the next protocol layer from current packet payload. |
Functions
- from_icmp (data)
-
Decode a raw ICMP packet.
Parameters:
- data string Raw ICMP bytes.
Returns:
-
ParsedPacket
Decoded ICMP packet.
Or
- nil On failure.
- string err Error message.
- from_icmp6 (data)
-
Decode a raw ICMPv6 packet.
Parameters:
- data string Raw ICMPv6 bytes.
Returns:
-
ParsedPacket
Decoded ICMPv6 packet.
Or
- nil On failure.
- string err Error message.
- from_ip (data)
-
Decode a raw IPv4 packet.
Parameters:
- data string Raw IPv4 bytes.
Returns:
-
ParsedPacket
Decoded IPv4 packet.
Or
- nil On failure.
- string err Error message.
- from_ip6 (data)
-
Decode a raw IPv6 packet.
Parameters:
- data string Raw IPv6 bytes.
Returns:
-
ParsedPacket
Decoded IPv6 packet.
Or
- nil On failure.
- string err Error message.
- from_ether (data)
-
Decode an Ethernet frame.
Parameters:
- data string Raw Ethernet frame bytes.
Returns:
-
ParsedPacket
Decoded Ethernet packet.
Or
- nil On failure.
- string err Error message.
- from_radiotap (data)
-
Decode an IEEE 802.11 frame from a radiotap packet.
This parser extracts commonly used management/data fields and selected information elements (for example SSID in beacon/probe frames).
Parameters:
- data string Raw radiotap packet bytes.
Returns:
-
ParsedPacket
Decoded 802.11 packet.
Or
- nil On failure.
- string err Error message.
- icmp (typ, code, id, sequence[, data=""[, checksum=false]])
-
Build an ICMP echo or echo-reply packet.
typmust be one ofsocket.ICMP_ECHOorsocket.ICMP_ECHOREPLY.Parameters:
- typ number ICMP type.
- code number ICMP code.
- id number Identifier.
- sequence number Sequence number.
- data string Payload. (default "")
- checksum boolean Whether to compute and fill checksum. (default false)
Returns:
-
string
Raw ICMP packet bytes.
- icmp6 (typ, code, id, sequence[, data=""[, checksum=false]])
-
Build an ICMPv6 echo request or echo reply packet.
typmust be one ofsocket.ICMPV6_ECHO_REQUESTorsocket.ICMPV6_ECHO_REPLY.Parameters:
- typ number ICMPv6 type.
- code number ICMPv6 code.
- id number Identifier.
- sequence number Sequence number.
- data string Payload. (default "")
- checksum boolean Whether to compute and fill checksum. (default false)
Returns:
-
string
Raw ICMPv6 packet bytes.
- udp (source, dest[, data=""[, saddr[, daddr]]])
-
Build a UDP packet.
If both
saddranddaddrare provided, UDP checksum is computed with an IPv4 pseudo-header.Parameters:
- source number Source port.
- dest number Destination port.
- data string UDP payload. (default "")
- saddr string IPv4 source address used for checksum. (optional)
- daddr string IPv4 destination address used for checksum. (optional)
Returns:
-
string
Raw UDP packet bytes.
- tcp (source, dest, seq, ack_seq[, flags[, window=false[, saddr=false[, daddr=false[, data=false]]]]])
-
Build a TCP packet (without options).
The header length is fixed to 20 bytes (
doff = 5), i.e. TCP options are not included.Parameters:
- source number Source port.
- dest number Destination port.
- seq number Sequence number.
- ack_seq number Acknowledgment number.
- flags TCP flags table.
- cwr boolean Congestion Window Reduced. (default false)
- ece boolean ECN-Echo. (default false)
- urg boolean Urgent pointer significant. (default false)
- ack boolean Acknowledgment valid. (default false)
- psh boolean Push function. (default false)
- rst boolean Reset connection. (default false)
- syn boolean Synchronize sequence numbers. (default false)
- fin boolean No more data from sender. (default false)
- window number Window size.
- saddr string IPv4 source address used for checksum.
- daddr string IPv4 destination address used for checksum.
- data string TCP payload. (default "")
Returns:
-
string
Raw TCP packet bytes.
- ip (saddr, daddr, protocol[, data=""])
-
Build an IPv4 packet.
This creates a minimal IPv4 header (no options) and computes header checksum automatically.
Parameters:
- saddr string Source IPv4 address.
- daddr string Destination IPv4 address.
- protocol number IP protocol number, e.g. socket.IPPROTO_UDP.
- data string IPv4 payload. (default "")
Returns:
-
string
Raw IPv4 packet bytes.
- arp (op[, sha="00:00:00:00:00:00"[, sip="0.0.0.0"[, tha="00:00:00:00:00:00"[, tip="0.0.0.0"]]]])
-
Build an ARP packet.
Common operations are
socket.ARPOP_REQUESTandsocket.ARPOP_REPLY.Parameters:
- op number ARP operation.
- sha string Sender MAC address. (default "00:00:00:00:00:00")
- sip string Sender IPv4 address. (default "0.0.0.0")
- tha string Target MAC address. (default "00:00:00:00:00:00")
- tip string Target IPv4 address. (default "0.0.0.0")
Returns:
-
string
Raw ARP packet bytes.
- ether (source, dest, proto[, data=""])
-
Build an Ethernet frame.
Parameters:
- source
string
Source MAC address, format
xx:xx:xx:xx:xx:xx. - dest
string
Destination MAC address, format
xx:xx:xx:xx:xx:xx. - proto
number
EtherType, e.g.
socket.ETH_P_IP. - data string Ethernet payload. (default "")
Returns:
-
string
Raw Ethernet frame bytes.
- source
string
Source MAC address, format
Class ParsedPacket
Decoded packet object returned by parser helpers.
Common fields:
name: protocol name, for example"ETHER","IP","TCP".proto(optional): next L3 ethertype, usually present on L2 packets.protocol(optional): next L4 protocol number, usually present on IP packets.data(optional): remaining payload bytes.source(optional): source address or source port depending on packet layer.dest(optional): destination address or destination port depending on packet layer.
- ParsedPacket:next ()
-
Decode the next protocol layer from current packet payload.
Returns:
-
ParsedPacket
next_pkt Decoded upper-layer packet.
Or
- nil On failure.
- string err Error message.