je-clark / last_packet Goto Github PK

parser.add_argument('infile', action='store', help='Input file. Must be a PCAP')

https://wiki.wireshark.org/Development/LibpcapFileFormat#global-header

magic_number: used to detect the file format itself and the byte ordering. The writing application writes 0xa1b2c3d4 with it's native byte ordering format into this field. The reading application will read either 0xa1b2c3d4 (identical) or 0xd4c3b2a1 (swapped). If the reading application reads the swapped 0xd4c3b2a1 value, it knows that all the following fields will have to be swapped too.

Not that someone would do it on purpose, but capture files come in all flavors and file extensions.
Extend the magic number check to verify that it actually is a PCAP file.

def determine_endianness(global_header): # Expect this to be a byte array
    magic_num_test = b'x\a1\xb2\xc3\xd4'
    magic_num = global_header[0:4]
    if magic_num == magic_num_test:
        return 'big'
    else:
        return 'little'