Reading binary using a struct - behavour not as expected?

[richardd]

Hi,
I am writing code to deal with PCAP files. I have a PCAP dump and I am
looking at the timestamps in the PCAP packet headers to see if they are in
the correct order in the file. To do this I have a class called
PCAPPacketHdr as follows

import struct

class PCAPPacketHdr:
FormatString = "LLLL"
TSSec = None
TSUSec = None
InclLen = None
OrigLen = None

def Pack(self):
return struct.pack( self.FormatStri ng, self.TSSec, self.TSUSec,
self.InclLen, self.OrigLen )

def Unpack(self, buffer):
self.TSSec, self.TSUSec, self.InclLen, self.OrigLen =
struct.unpack( self.FormatStri ng, buffer )

def Size(self):
return struct.calcsize (self.FormatStr ing)
I then have code which opens up the file (skipping the PCAP file magic
number and PCAP file header), and reads in each packet header as follows:

while not eof:
#read in PCAPPacketHdr
buf = curFile.read(pa cketHdr.Size())
if len(buf) == packetHdr.Size( ):
packetHdr.Unpac k(buf)
if lastPacketHdr != None:
if lastPacketHdr.T SSec > packetHdr.TSSec :
outputFile.writ e("ERROR: Packet TSSec earlier than last
one: \n")
outputFile.writ e(" Last Packet
"+repr(lastPack etHdr.TSSec)+". "+repr(lastPack etHdr.TSUSec)+" \n")
elif lastPacketHdr.T SSec == packetHdr.TSSec :
if lastPacketHdr.T SUSec > packetHdr.TSUSe c:
outputFile.writ e("ERROR: Packet TSUSec earlier than
last one\n")
outputFile.writ e(" Last Packet
"+repr(lastPack etHdr.TSSec)+". "+repr(lastPack etHdr.TSUSec)+" \n")
outputFile.writ e(" Packet
"+repr(packetHd r.TSSec)+"."+re pr(packetHdr.TS USec)+"\n")
lastPacketHdr = copy.deepcopy(p acketHdr)
#skip packet payload
packetPayload = curFile.read(pa cketHdr.InclLen )
else:
eof = True
This code appears to work fine for extracting the timestamps from the file,
the repr( ) calls on the timestamps allow me to write them to the output
file correctly, it's just the comparison operators don't appear to be
working as I would expect. It appears than when the TSUSec timestamp is the
same as the previous one in the data I input, it reports "ERROR: Packet
TSUSec earlier than last one".

This makes me think that the comparison operators aren't acting on the data
as longs as I expected.

Can anyone shed some light on what I'm doing wrong, I'm still very new to
Python.

Thanks in advance,

Rich

[Larry Bates]

Rich,

Ok, your problem is this:

When you define attributes immediately after
the class definition they are SHARED among
all instances of the class. Basically they are
global (actually this can come in handy if you
want to keep counters across class instances).
You were copying into lastcopy, but everytime
you unpacked, you overwrote your shared attributes.

Try this instead:

class PCAPPacketHdr:
#
# Attributes defined here are global across
# instances of this class.
#
FormatString = "LLLL"

def __init__(self):
#
# Attributes defined here are local to
# the class instance.
#
self.TSSec = None
self.TSUSec = None
self.InclclLen = None
self.OrigLen = None
return

This will share FormatString (it doesn't change),
but have individual attributes for the other
values you wish to be unique between two different
instances of the class.

Regards,
Larry Bates
Syscon, Inc.

"richardd" <ri******@hmgcc .gov.uk> wrote in message
news:40******** @mail.hmgcc.gov .uk...

Hi,
I am writing code to deal with PCAP files. I have a PCAP dump and I am
looking at the timestamps in the PCAP packet headers to see if they are in
the correct order in the file. To do this I have a class called
PCAPPacketHdr as follows

import struct

class PCAPPacketHdr:
FormatString = "LLLL"
TSSec = None
TSUSec = None
InclLen = None
OrigLen = None

def Pack(self):
return struct.pack( self.FormatStri ng, self.TSSec, self.TSUSec,
self.InclLen, self.OrigLen )

def Unpack(self, buffer):
self.TSSec, self.TSUSec, self.InclLen, self.OrigLen =
struct.unpack( self.FormatStri ng, buffer )

def Size(self):
return struct.calcsize (self.FormatStr ing)
I then have code which opens up the file (skipping the PCAP file magic
number and PCAP file header), and reads in each packet header as follows:

while not eof:
#read in PCAPPacketHdr
buf = curFile.read(pa cketHdr.Size())
if len(buf) == packetHdr.Size( ):
packetHdr.Unpac k(buf)
if lastPacketHdr != None:
if lastPacketHdr.T SSec > packetHdr.TSSec :
outputFile.writ e("ERROR: Packet TSSec earlier than last
one: \n")
outputFile.writ e(" Last Packet
"+repr(lastPack etHdr.TSSec)+". "+repr(lastPack etHdr.TSUSec)+" \n")
elif lastPacketHdr.T SSec == packetHdr.TSSec :
if lastPacketHdr.T SUSec > packetHdr.TSUSe c:
outputFile.writ e("ERROR: Packet TSUSec earlier than
last one\n")
outputFile.writ e(" Last Packet
"+repr(lastPack etHdr.TSSec)+". "+repr(lastPack etHdr.TSUSec)+" \n")
outputFile.writ e(" Packet
"+repr(packetHd r.TSSec)+"."+re pr(packetHdr.TS USec)+"\n")
lastPacketHdr = copy.deepcopy(p acketHdr)
#skip packet payload
packetPayload = curFile.read(pa cketHdr.InclLen )
else:
eof = True
This code appears to work fine for extracting the timestamps from the file, the repr( ) calls on the timestamps allow me to write them to the output
file correctly, it's just the comparison operators don't appear to be
working as I would expect. It appears than when the TSUSec timestamp is the same as the previous one in the data I input, it reports "ERROR: Packet
TSUSec earlier than last one".

This makes me think that the comparison operators aren't acting on the data as longs as I expected.

Can anyone shed some light on what I'm doing wrong, I'm still very new to
Python.

Thanks in advance,

Rich