利用Tshark和PDML实现网络数据包十六进制字节到字段的映射

tshark -r input.pcap -T pdml > output.pdml

<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="pdml2html.xsl"?>
<pdml version="0" creator="wireshark/3.4.10" time="1678886400">
  <packet>
    <proto name="geninfo" pos="0" size="100">
      <!-- General packet info -->
    </proto>
    <proto name="eth" eng_name="Ethernet" pos="0" size="14">
      <field name="eth.dst" show="ff:ff:ff:ff:ff:ff" size="6" pos="0" value="ffffffffffff"/>
      <field name="eth.src" show="00:00:00:00:00:00" size="6" pos="6" value="000000000000"/>
      <field name="eth.type" show="0x0800" size="2" pos="12" value="0800"/>
    </proto>
    <proto name="ip" eng_name="Internet Protocol Version 4" pos="14" size="20">
      <field name="ip.version" show="4" size="1" pos="14" value="45" display_as="Bits 0-3 of byte 0: 4"/>
      <field name="ip.hdr_len" show="20 bytes (5)" size="1" pos="14" value="45" display_as="Bits 4-7 of byte 0: 5"/>
      <!-- More IP fields -->
    </proto>
    <!-- Other layers and fields -->
  </packet>
</pdml>

import xml.etree.ElementTree as ET

def parse_pdml_for_byte_mapping(pdml_file_path):
    """
    解析PDML文件，提取每个字段在数据包中的位置和大小信息。
    返回一个列表，其中每个元素包含字段名、起始位置和长度。
    """
    byte_mappings = []
    try:
        tree = ET.parse(pdml_file_path)
        root = tree.getroot()

        for packet in root.findall('packet'):
            # 遍历每个数据包
            for proto in packet.findall('proto'):
                # 遍历每个协议层
                proto_name = proto.get('name')

                # 提取协议层自身的字段信息（如果需要，例如协议头长度等）
                # 这里我们主要关注子字段

                for field in proto.findall('field'):
                    field_name = field.get('name')
                    field_pos = int(field.get('pos'))
                    field_size = int(field.get('size'))

                    byte_mappings.append({
                        "layer": proto_name,
                        "field": field_name,
                        "start_byte": field_pos,
                        "end_byte": field_pos + field_size - 1 # 包含结束字节
                    })
    except ET.ParseError as e:
        print(f"Error parsing PDML file: {e}")
    except FileNotFoundError:
        print(f"PDML file not found: {pdml_file_path}")
    return byte_mappings

# 示例使用
# pdml_data = parse_pdml_for_byte_mapping("output.pdml")
# for mapping in pdml_data:
#     print(mapping)

[
    {'layer': 'eth', 'field': 'eth.dst', 'start_byte': 0, 'end_byte': 5},
    {'layer': 'eth', 'field': 'eth.src', 'start_byte': 6, 'end_byte': 11},
    {'layer': 'eth', 'field': 'eth.type', 'start_byte': 12, 'end_byte': 13},
    {'layer': 'ip', 'field': 'ip.version', 'start_byte': 14, 'end_byte': 14}, # 注意这里的size=1，pos=14
    {'layer': 'ip', 'field': 'ip.hdr_len', 'start_byte': 14, 'end_byte': 14}, # 同一字节的不同位可能属于不同字段
    # ... 更多字段
]

def identify_byte_representation(byte_position, byte_mappings):
    """
    根据字节位置，在映射表中查找其所属的协议层和字段。
    """
    results = []
    for mapping in byte_mappings:
        if mapping["start_byte"] <= byte_position <= mapping["end_byte"]:
            results.append({
                "byte_position": byte_position,
                "layer": mapping["layer"],
                "field": mapping["field"]
            })
    return results

# 示例：查询第14个字节（从0开始计数）代表什么
# target_byte_position = 14
# identified_fields = identify_byte_representation(target_byte_position, pdml_data)
# for item in identified_fields:
#     print(f"Byte {item['byte_position']} represents: Layer '{item['layer']}', Field '{item['field']}'")