IP Datagram Analysis¶

pcapkit.foundation.analysis.ip contains ip_datagram() only, which parses the payload of an IPv4 or IPv6 datagram that IPv4 or IPv6 reassembled.

pcapkit.foundation.analysis.ip.ip_datagram(datagram)[source]¶

Parse the payload of an IP datagram reassembled by IPv4 or IPv6.

The payload is dispatched on the datagram’s payload protocol type – the Protocol field for IPv4, the Fragment header’s Next Header for IPv6 – by Protocol.analyze of IPv4 or IPv6, whichever the datagram’s addresses belong to.

Parameters:: datagram (Datagram) – Reassembled datagram (reasm.ipv4.datagram or reasm.ipv6.datagram).
Return type:: ProtocolBase | None
Returns:: The parsed payload. A payload reported as one contiguous run is parsed whether or not datagram is complete, as strict=False reports an incomplete one. None if the payload is the tuple of runs received, as strict=True reports an incomplete one.

Note

Datagram.packet holds the same result, parsed on its first read, unless the reassembly’s __protocol_type__ names another protocol, which then parses it instead.