Get TCP Flags with Scapy

packet, packet-capture, python, scapy, tcp

Solution

Normally, the usual way to handle FLAGS is with a bitmap and bitwise operators. If your `Packet` class doesn't have specific method to test for flags, the best thing you can do IMHO is to:

FIN = 0x01
SYN = 0x02
RST = 0x04
PSH = 0x08
ACK = 0x10
URG = 0x20
ECE = 0x40
CWR = 0x80

And test them like this:

F = p['TCP'].flags    # this should give you an integer
if F & FIN:
    # FIN flag activated
if F & SYN:
    # SYN flag activated
# rest of the flags here

Sadly, python doesn't have a `switch` statement to make this more elegant but it doesn't really matter much.

Hope this helps!

Problem

I'm parsing a PCAP file and I need to extract TCP flags (SYN, ACK, PSH, URG, ...). I'm using the `packet['TCP'].flags` value to obtain all the flags at once. ``` pkts = PcapReader(infile) for p in pkts: F = bin(p['TCP'].flags) print F, bin(F), p.summary() # manual flags extraction from F ``` Is there a way to obtain a single TCP flag without manually extract it from `packet['TCP'].flags` value?

Original source