Get TCP Flags with Scapy

Question

I'm parsing a PCAP file and I need to extract TCP flags (SYN, ACK, PSH, URG, ...). I'm using the packet['TCP'].flags value to obtain all the flags at once.

pkts = PcapReader(infile)
for p in pkts:
        F = bin(p['TCP'].flags)
        print F, bin(F), p.summary()
        # manual flags extraction from F

Is there a way to obtain a single TCP flag without manually extract it from packet['TCP'].flags value?

So you're saying the above approach works? What is the issue with the code? — Simeon Visser, Dec 06 '13 at 17:38

Paulo Bu · Accepted Answer · 2013-12-06T18:23:34.577

Normally, the usual way to handle FLAGS is with a bitmap and bitwise operators. If your Packet class doesn't have specific method to test for flags, the best thing you can do IMHO is to:

FIN = 0x01
SYN = 0x02
RST = 0x04
PSH = 0x08
ACK = 0x10
URG = 0x20
ECE = 0x40
CWR = 0x80

And test them like this:

F = p['TCP'].flags    # this should give you an integer
if F & FIN:
    # FIN flag activated
if F & SYN:
    # SYN flag activated
# rest of the flags here

Sadly, python doesn't have a switch statement to make this more elegant but it doesn't really matter much.

Hope this helps!

Pierre · Answer 2 · 2016-12-16T14:06:52.433

16

You can use the Packet.sprintf() method:

>>> p = IP()/TCP(flags=18)
>>> p.sprintf('%TCP.flags%')
'SA'

If you want the "long" names, use a dict instead of a long if...elif... expression (dict are often used in Python when you would use a switch in other languages):

>>> flags = {
    'F': 'FIN',
    'S': 'SYN',
    'R': 'RST',
    'P': 'PSH',
    'A': 'ACK',
    'U': 'URG',
    'E': 'ECE',
    'C': 'CWR',
}
>>> [flags[x] for x in p.sprintf('%TCP.flags%')]
['SYN', 'ACK']

edited Dec 16 '16 at 14:06

answered Jan 25 '14 at 14:39

Pierre

6,047
1
30
49

does the 'SA' flag signify an "SYN-ACK" packet? – Dylan Ong Aug 07 '22 at 14:32
1

Yes it does, each flag has a short (1 letter) and a long (3 letters) representation. When using the short, one would usually write flags together ("SA"), while when using the long, one would use a separator ("-" or "+", so "SYN-ACK" or "SYN+ACK"). – Pierre Aug 11 '22 at 12:46

score 8 · Answer 3 · answered Jan 03 '19 at 20:05

8

This also works.

if packet[TCP].flags.F:
    print('FIN received')

answered Jan 03 '19 at 20:05

Dragonborn

1,755
1
16
37

it probably uses the `__getattr__` semantics https://python-reference.readthedocs.io/en/latest/docs/dunderattr/getattr.html – Dragonborn May 25 '21 at 20:41

Pierre · Answer 4 · 2018-03-24T21:28:41.920

3

Another option, for the record, which did not exist by the time this question was asked. It works with current Scapy development version (the first release including this change will be 2.4.0; 2.4.0rc* also include it).

You can now use str() on the flag value:

>>> p = IP()/TCP(flags=18)
>>> p[TCP].flags
<Flag 18 (SA)>
>>> str(p[TCP].flags)
'SA'

edited Mar 24 '18 at 21:28

answered Jul 24 '17 at 08:04

Pierre

6,047
1
30
49

Get TCP Flags with Scapy

4 Answers4

Linked