Ask Your Question
0

why I can't save tcp.analysis_ack_rtt or tcp.analysis_acks_frame

asked 2020-07-04 21:52:59 +0000

order999 gravatar image

I am trying to query these two attributes. But then none of the packets contain these attributes will show up. please help. thanks, print(pkt.tcp) print(pkt.tcp.analysis_ack_rtt) print(pkt.tcp.analysis.acks_frame)

edit retag flag offensive close merge delete

Comments

As your question is apparently about pyshark, which is an external project, it's off-topic for this site and you should contact the support channels for that project.

grahamb gravatar imagegrahamb ( 2020-07-05 15:11:57 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-07-04 22:14:54 +0000

Chuckc gravatar image

Those are generated fields created by Wireshark when the capture is read in.

doc/README.dissector:
proto_item_set_generated()
--------------------------
proto_item_set_generated is used to mark fields as not being read from the
captured data directly, but inferred from one or more values.

They are set in packet-tcp.c

     /* encapsulate all proto_tree_add_xxx in ifs so we only print what
        data we actually have */
     if(ta->frame_acked) {
          item = proto_tree_add_uint(tree, hf_tcp_analysis_acks_frame,
            tvb, 0, 0, ta->frame_acked);
             proto_item_set_generated(item);

         /* only display RTT if we actually have something we are acking */
         if( ta->ts.secs || ta->ts.nsecs ) {
             item = proto_tree_add_time(tree, hf_tcp_analysis_ack_rtt,
             tvb, 0, 0, &ta->ts);
                 proto_item_set_generated(item);
         }
      }
edit flag offensive delete link more

Comments

Thanks for the fast reply,

I still have a few questions

  1. According to the code

if tcp_analysis->frame_acked is defined, RTT and frame_acked will be deferred using proto_tree_add_* functions, right? I assume this is run by wireshark to populate those fields in the program.

  1. In the packet captured using pyshark those fields are filled in (for ack packets). Because I can print those packets and see the fields with valid infos. But whenever I tried to query those fields, I got nothing.

The code I used is like this:

print(pkt.ip.src, pkt.ip.dst, pkt.tcp.ack, pkt.tcp.seq, pkt.tcp.flags) // always working pkt.tcp.pretty_print() //dumps the content in tcp packet, can display info of packets including ack packet if I dont have the next line which tried to query the two optional fields; it can't print any ack packet when I tried to query ...(more)

order999 gravatar imageorder999 ( 2020-07-05 14:50:07 +0000 )edit

Checking first with tshark to verify fields exist:

$ tshark -r ./mycapture.pcap -T fields -e frame.number -e tcp.analysis.acks_frame -e tcp.analysis.ack_rtt -c 5
1       
2   1   0.000051000
3       
4   3   0.004343000
5       
$ 


$ python3
Python 3.6.9 (default, Apr 18 2020, 01:56:04) 
[GCC 8.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import pyshark
>>> cap = pyshark.FileCapture('./mycapture.pcap')
>>> print(cap[1].tcp.analysis_acks_frame);
1
>>> print(cap[1].tcp.analysis_ack_rtt);
0.000051000
>>>

Accessing packet data: mentions dir to see the fields:

>>> dir(cap[1].tcp);
['', 'DATA_LAYER', '__class__', '__delattr__', '__dict__', '__dir__', '__doc__', '__eq__', '__format__', '__ge__', '__getattr__', '__getattribute__', '__getstate__', '__gt__', '__hash__', '__init__', '__init_subclass__', '__le__', '__lt__', '__module__', '__ne__', '__new__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__setstate__', '__sizeof__', '__str__', '__subclasshook__', '__weakref__', '_all_fields', '_field_prefix', '_get_all_field_lines', '_get_all_fields_with_alternates', '_get_field_or_layer_repr', '_get_field_repr', '_layer_name', '_sanitize_field_name', 'ack', 'analysis', 'analysis_ack_rtt', 'analysis_acks_frame', 'checksum', 'checksum_status', 'dstport', 'field_names ...
(more)
Chuckc gravatar imageChuckc ( 2020-07-05 16:20:46 +0000 )edit

this will help. thanks,

order999 gravatar imageorder999 ( 2020-07-05 16:28:14 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2020-07-04 21:52:59 +0000

Seen: 74 times

Last updated: Jul 05