parse_check.py

from scapy.all import rdpcap, Raw

def parse_tlv_body(buf: bytes):
    i = 0
    n = len(buf)
    start_l = buf[i + 1]
    if start_l == 0:
        return None
    print(start_l)
    parsed_at_least_one = False
    while i + 2 <= n:
        l = buf[i + 1]
        total = 2 + l
        if i + total > n:
            break
        i += total
        parsed_at_least_one = True
    if parsed_at_least_one:
        return start_l
    return None


def parse_with_unknown_header(buf: bytes, Hmax: int):

    for h in range(Hmax + 1):
        if h >= len(buf):
            break
        res = parse_tlv_body(buf[h:])
        if res is not None:
            return h,  res
    return None


def extract_bgp_payload(pcap_file):
    packets = rdpcap(pcap_file)
    messages = []
    for pkt in packets:
        raw = pkt.getlayer(Raw)
        if raw:
            payload = raw.load
            messages.append(payload)
    return messages


if __name__ == "__main__":
    pcap_file = "pcaps/dataset/bgp_1_packet.pcap"
    bodies = extract_bgp_payload(pcap_file)
    for idx, body in enumerate(bodies):
        consumed = parse_with_unknown_header(body, Hmax=50)
        print(f"Packet {idx}: body length = {len(body)}, TLVs consumed = {consumed}")