IPv4 Datagram Reassembly#

pcapkit.foundation.reassembly.ipv4 contains IPv4 only, which reconstructs fragmented IPv4 packets back to origin. Please refer to Base Class for more information.

class pcapkit.foundation.reassembly.ipv4.IPv4(*, strict=True, store=True)[source]#

Bases: IP

Reassembly for IPv4 payload.

Parameters:

strict (bool) – if return all datagrams (including those not implemented) when submit
store (bool) – if store reassembled datagram in memory, i.e., self._dtgram (if not, datagram will be discarded after callback)

Example

>>> from pcapkit.foundation.reassembly import IPv4
# Initialise instance:
>>> ipv4_reassembly = IPv4()
# Call reassembly:
>>> ipv4_reassembly(packet_dict)
# Fetch result:
>>> result = ipv4_reassembly.datagram

__protocol_name__: str = 'IPv4'#: Protocol name of current reassembly object.

__protocol_type__(file=None, length=None, **kwargs): Type[Protocol] = <class 'pcapkit.protocols.internet.ipv4.IPv4'>#: Protocol of current reassembly object.

Terminology#

reasm.ipv4.packet#

Data structure for IPv4 datagram reassembly (IPv4.reassembly) is as following:

packet_dict = dict(
  bufid = tuple(
      ipv4.src,                   # source IP address
      ipv4.dst,                   # destination IP address
      ipv4.id,                    # identification
      ipv4.proto,                 # payload protocol type
  ),
  num = frame.number,             # original packet range number
  fo = ipv4.frag_offset,          # fragment offset
  ihl = ipv4.hdr_len,             # internet header length
  mf = ipv4.flags.mf,             # more fragment flag
  tl = ipv4.len,                  # total length, header includes
  header = ipv4.header,           # raw bytes type header
  payload = ipv4.payload,         # raw bytearray type payload
)

reasm.ipv4.datagram#

Data structure for reassembled IPv4 datagram (element from IPv4.datagram tuple) is as following:

(tuple) datagram
 |--> (Info) data
 |     |--> 'completed' : (bool) True --> implemented
 |     |--> 'id' : (Info) original packet identifier
 |     |            |--> 'src' --> (IPv4Address) ipv4.src
 |     |            |--> 'dst' --> (IPv4Address) ipv4.dst
 |     |            |--> 'id' --> (int) ipv4.id
 |     |            |--> 'proto' --> (EtherType) ipv4.proto
 |     |--> 'index' : (tuple) packet numbers
 |     |               |--> (int) original packet range number
 |     |--> 'header' : (bytes) IPv4 header
 |     |--> 'payload' : (bytes) reassembled IPv4 payload
 |     |--> 'packet' : (Protocol) parsed reassembled payload
 |--> (Info) data
 |     |--> 'completed' : (bool) False --> not implemented
 |     |--> 'id' : (Info) original packet identifier
 |     |            |--> 'src' --> (IPv4Address) ipv4.src
 |     |            |--> 'dst' --> (IPv4Address) ipv4.dst
 |     |            |--> 'id' --> (int) ipv4.id
 |     |            |--> 'proto' --> (EtherType) ipv4.proto
 |     |--> 'index' : (tuple) packet numbers
 |     |               |--> (int) original packet range number
 |     |--> 'header' : (bytes) IPv4 header
 |     |--> 'payload' : (tuple) partially reassembled IPv4 payload
 |     |                 |--> (bytes) IPv4 payload fragment
 |     |                 |--> ...
 |     |--> 'packet' : (None)
 |--> (Info) data ...

reasm.ipv4.buffer#

Data structure for internal buffering when performing reassembly algorithms (IPv4._buffer) is as following:

(dict) buffer --> memory buffer for reassembly
 |--> (tuple) BUFID : (dict)
 |     |--> ipv4.src       |
 |     |--> ipv4.dst       |
 |     |--> ipv4.id        |
 |     |--> ipv4.proto     |
 |                         |--> 'TDL' : (int) total data length
 |                         |--> 'RCVBT' : (bytearray) fragment received bit table
 |                         |               |--> (bytes) b'\\x00' -> not received
 |                         |               |--> (bytes) b'\\x01' -> received
 |                         |               |--> (bytes) ...
 |                         |--> 'index' : (list) list of reassembled packets
 |                         |               |--> (int) packet range number
 |                         |--> 'header' : (bytes) header buffer
 |                         |--> 'datagram' : (bytearray) data buffer, holes set to b'\\x00'
 |--> (tuple) BUFID ...