Path: csiph.com!usenet.pasdenom.info!news.redatomik.org!newsfeed.xs4all.nl!newsfeed8.news.xs4all.nl!post.news.xs4all.nl!not-for-mail
Return-Path: <lac@openend.se>
X-Original-To: python-list@python.org
Delivered-To: python-list@mail.python.org
X-Spam-Status: OK 0.004
X-Spam-Evidence: '*H*': 0.99; '*S*': 0.00; 'url:bitbucket': 0.05; 'received:openend.se': 0.09; 'received:theraft.openend.se': 0.09; 'cc:addr:python-list': 0.10; 'example:': 0.11; 'output': 0.15; 'cc:addr:lac': 0.16; 'cc:addr:openend.se': 0.16; 'from:addr:lac': 0.16; 'from:addr:openend.se': 0.16; 'from:name:laura creighton': 0.16; 'message-id:@fido.openend.se': 0.16; 'normal,': 0.16; 'packets.': 0.16; 'received:89.233': 0.16; 'received:89.233.217': 0.16; 'received:89.233.217.133': 0.16; 'received:fido': 0.16; 'received:fido.openend.se': 0.16; 'laura': 0.18; 'cc:2**2': 0.20; 'cc:addr:python.org': 0.21; 'see:': 0.22; 'cc:no real name:2**0': 0.23; '2015': 0.23; 'file.': 0.24; 'import': 0.24; 'header:In- Reply-To:1': 0.24; 'mon,': 0.24; 'received:se': 0.29; 'there.': 0.30; 'url:wiki': 0.30; 'file': 0.34; 'that,': 0.34; 'returning': 0.35; 'something': 0.35; 'but': 0.36; 'url:org': 0.36; 'there': 0.36; 'turn': 0.37; 'subject:: ': 0.37; 'charset:us-ascii': 0.37; 'thought': 0.37; 'list.': 0.37; 'mailing': 0.38; 'forget': 0.60; 'per': 0.61; 'header:Message-Id:1': 0.62; 'url:index': 0.64; 'reply': 0.67; '>from': 0.76; 'received:89': 0.80; 'to:addr:cisco.com': 0.84; '262': 0.91
To: "Devaki Chokshi (dchokshi)" <dchokshi@cisco.com>
cc: "lac@openend.se" <lac@openend.se>, "python-list@python.org" <python-list@python.org>, lac@openend.se
From: Laura Creighton <lac@openend.se>
Subject: Re: Scapy and MGCP
In-Reply-To: Message from "Devaki Chokshi (dchokshi)" <dchokshi@cisco.com> of "Mon, 29 Jun 2015 20:06:05 -0000." <E0FE14A926805D41A32BEA79FD6E7AD626469C43@xmb-rcd-x10.cisco.com>
References: <E0FE14A926805D41A32BEA79FD6E7AD626469C43@xmb-rcd-x10.cisco.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <11765.1435609152.1@fido>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 29 Jun 2015 22:19:12 +0200
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.3.9 (theraft.openend.se [89.233.217.130]); Mon, 29 Jun 2015 22:19:14 +0200 (CEST)
X-BeenThere: python-list@python.org
X-Mailman-Version: 2.1.20+
Precedence: list
List-Id: General discussion list for the Python programming language <python-list.python.org>
List-Unsubscribe: <https://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe>
List-Archive: <http://mail.python.org/pipermail/python-list/>
List-Post: <mailto:python-list@python.org>
List-Help: <mailto:python-list-request@python.org?subject=help>
List-Subscribe: <https://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe>
Newsgroups: comp.lang.python
Message-ID: <mailman.169.1435609166.3674.python-list@python.org>
Lines: 45
NNTP-Posting-Host: 2001:888:2000:d::a6
X-Trace: 1435609166 news.xs4all.nl 2959 [2001:888:2000:d::a6]:39781
X-Complaints-To: abuse@xs4all.nl
Xref: csiph.com comp.lang.python:93292

In a message of Mon, 29 Jun 2015 20:06:05 -0000, "Devaki Chokshi (dchokshi=
)" wr
ites:
>Hello,
>
>As per reply received I have begun to use scapy for MGCP. =

>
>I started off with  reading a .pcap file with MGCP packets. =

>
>For example:
>
>from scapy.all import *
>from scapy.utils import *
>from scapy.layers.mgcp import *
>
>mgcp_pkts =3D rdpcap("my-mgcp-capture.pcap")
>
>However, rdpcap() is returning all MGCP packets as UDP packets. The outpu=
t is something like:
>
><my-mgcp-capture.pcap: TCP:33 UDP:262 ICMP:1 Other:0>
>
>All 262 UDP packets are actually MGCP packets. =

>
>I would have thought rdpcap() will understand MGCP packet format. =

>
>Would appreciate help on how I can make scapy read MGCP packets from a .p=
cap file.
>
>Thank you
>Devaki

Ask on the secdev mailing list.
see: https://bitbucket.org/secdev/scapy/wiki/doc/index

This 'everything is UDP' is normal, but I forget how to turn it off
if you don't want that, and it's been over 3 years so there may be
better ways than what I used .... plus for me it wasn't MGCP packets
anyhow.  At any rate  they will know over there.

Laura