codegate 2012 prequal network 100

자, 패킷 포맷을 제대로 이해했다면 이제 실전에 적용해 보자.

실전에 적용해 보기 위해 아주 좋은 예제가 있다.

코드게이트 2012년 prequal 네트워크 100 문제~

파일 이름은 10_Floor.pcap으로 명명했다.

See on the link below to refer to pcap file format.

http://n20kim.blogspot.kr/2013/02/pcap-file-format.html

Wireshark can't open the pcap file.

If you understand pcap file format, you could notice what is weird.
Yeah, right!
pcap has global header at the beginning of the pcap. :)

# recover the pcap's global header.

1.make global header to add global header to the pcap.
   To make this, I made this code. It's simple but entering line by line is a little bit annoying

import binascii
binary=binascii.unhexlify("d4c3b2a1020004000000000000000000ffff000001000000")
f=open('header.pcap','w')
f.write(binary)
f.close()

2. add global header to the pcap

But an error still occurs because of size. phew...

Fix it again!

3. Did you notice something? The problem is size... and 22nd packet is normal.
   So you can infer that 23rd packet is probably abnormal.
   22nd packet byte streams is following:

4. The last line from 0x0038 is "16 d0 e3 42 ... "
    Find that byte streams in the 10_Floor.pcap
    23rd packet starts with "3e ec 60 ..".
    Packet header has 16bytes as you know.
    You can see "GET .." instead of packet header bytes. weird...

 

 

5. The final task is removing 23rd packet. Then you can open the pcap.




 

pcap file format

http://wiki.wireshark.org/Development/LibpcapFileFormat#File_Format

패킷 헤더의 구조를 알면 패킷을 분석할 때 유용하다. 잘 알아둘 필요가 있다. wireshark에서 제공하는 문서를 잘 이해해 두기 바란다~

The Libpcap's format is following:

Global header | Packet Header | Packet Data | Packet Header | Packet Data | ...


# Global header has the following structure:

typedef struct pcap_hdr_s {
        guint32 magic_number;   /* magic number */
        guint16 version_major;  /* major version number */
        guint16 version_minor;  /* minor version number */
        gint32  thiszone;       /* GMT to local correction */
        guint32 sigfigs;        /* accuracy of timestamps */
        guint32 snaplen;        /* max length of captured packets, in octets */
        guint32 network;        /* data link type */
} pcap_hdr_t;


# Record (Packet) Header has the following structure:

typedef struct pcaprec_hdr_s {
        guint32 ts_sec;         /* timestamp seconds */
        guint32 ts_usec;        /* timestamp microseconds */
        guint32 incl_len;       /* number of octets of packet saved in file */
        guint32 orig_len;       /* actual length of packet */
} pcaprec_hdr_t;