Transform a Scapy packet to JSON data

pkg_to_json.py

# -*- coding: utf-8 -*-

"""
This file contains the function to convert a Scapy packet to JSON representation
"""
from __future__ import print_function

import json

from collections import defaultdict


__author__ = "Daniel Garcia (cr0hn) - @ggdaniel"


def pkg_to_json(pkg):
	"""
	This function convert a Scapy packet to JSON
	
	:param pkg: A scapy package 
	:type pkg: objects
	
	:return: A JSON data
	:rtype: dict()

	"""
	results = defaultdict(dict)

	try:
		for index in range(50):

			layer = pkg[index]

			# Get layer name
			layer_tmp_name = str(layer.__dict__["aliastypes"][0])
			layer_start_pos = layer_tmp_name.rfind(".") + 1
			layer_name = layer_tmp_name[layer_start_pos:-2].lower()

			# Get the layer info
			tmp_t = {}
			for x, y in layer.__dict__["default_fields"].items():
				if y and not isinstance(y, (str, int, long, float, list, dict)):
					tmp_t[x].update(pkg_to_json(y))
				else:
					tmp_t[x] = y
			results[layer_name] = tmp_t

			try:
				tmp_t = {}
				for x, y in layer.__dict__["fields"].items():
					if y and not isinstance(y, (str, int, long, float, list, dict)):
						tmp_t[x].update(pkg_to_json(y))
					else:
						tmp_t[x] = y
				results[layer_name] = tmp_t

			except KeyError:
				# No custom fields
				pass

	except IndexError:
		# Package finish -> do nothing
		pass

	return json.dumps(results)


if __name__ == '__main__':
	from scapy.all import IP, TCP, DNS, DNSQR, UDP

	# print(pkg_to_json(IP(dst="8.8.8.8")/TCP(dport=80)/"hello World"))
	print(pkg_to_json(IP(dst="8.8.8.8")/UDP(dport=53)/DNS()/DNSQR(qname="terra.es")))

There is a irrelevant typo. The func name should be pkt_to_json (pkt). The same apply to the param doc.

I'm assuming this is for Python 2 due to line 6, but it's not working for me, neither using Python 2.7 nor 3.5 (after 2to3 auto fixes):

[  7:03PM ]  [ bruno@lain:~/CoAP-VS/porting-test ]
 $ python2.7 pkg_to_json.py 
Traceback (most recent call last):
  File "pkg_to_json.py", line 72, in <module>
    print(pkg_to_json(IP(dst="8.8.8.8")/UDP(dport=53)/DNS()/DNSQR(qname="terra.es")))
  File "pkg_to_json.py", line 35, in pkg_to_json
    layer_tmp_name = str(layer.__dict__["aliastypes"][0])
  File "/usr/local/lib/python2.7/dist-packages/scapy/packet.py", line 192, in __getattr__
    fld,v = self.getfield_and_val(attr)
  File "/usr/local/lib/python2.7/dist-packages/scapy/packet.py", line 189, in getfield_and_val
    return self.payload.getfield_and_val(attr)
  File "/usr/local/lib/python2.7/dist-packages/scapy/packet.py", line 189, in getfield_and_val
    return self.payload.getfield_and_val(attr)
  File "/usr/local/lib/python2.7/dist-packages/scapy/packet.py", line 189, in getfield_and_val
    return self.payload.getfield_and_val(attr)
  File "/usr/local/lib/python2.7/dist-packages/scapy/packet.py", line 189, in getfield_and_val
    return self.payload.getfield_and_val(attr)
  File "/usr/local/lib/python2.7/dist-packages/scapy/packet.py", line 1125, in getfield_and_val
    raise AttributeError(attr)
AttributeError: __dict__
[  7:03PM ]  [ bruno@lain:~/CoAP-VS/porting-test ]
 $ python3.5 pkg_to_json35.py
WARNING: No route found for IPv6 destination :: (no default route?). This affects only IPv6
Traceback (most recent call last):
  File "pkg_to_json35.py", line 72, in <module>
    print(pkg_to_json(IP(dst="8.8.8.8")/UDP(dport=53)/DNS()/DNSQR(qname="terra.es")))
  File "pkg_to_json35.py", line 43, in pkg_to_json
    tmp_t[x].update(pkg_to_json(y))
KeyError: 'qname'

Any suggestions?

In anaconda 3.5, jupyter cell, when I call the function with a packet

> KeyError                                  Traceback (most recent call last)
> <ipython-input-64-0bfed3ab77b3> in <module>
> ----> 1 pkg_to_json(pfh[1])
> 
> <ipython-input-63-50653fd7dd41> in pkg_to_json(pkg)
>      27 
>      28                         # Get layer name
> ---> 29                         layer_tmp_name = str(layer.__dict__["aliastypes"][0])
>      30                         layer_start_pos = layer_tmp_name.rfind(".") + 1
>      31                         layer_name = layer_tmp_name[layer_start_pos:-2].lower()
> 
> KeyError: 'aliastypes'

am I missing something?

@mahmutkocak get the same Error, could you resolve it?

layer_tmp_name = str(layer.__dict__["aliastypes"][0]

KeyError: 'aliastypes'

In anaconda 3.5, jupyter cell, when I call the function with a packet

> KeyError                                  Traceback (most recent call last)
> <ipython-input-64-0bfed3ab77b3> in <module>
> ----> 1 pkg_to_json(pfh[1])
> 
> <ipython-input-63-50653fd7dd41> in pkg_to_json(pkg)
>      27 
>      28                         # Get layer name
> ---> 29                         layer_tmp_name = str(layer.__dict__["aliastypes"][0])
>      30                         layer_start_pos = layer_tmp_name.rfind(".") + 1
>      31                         layer_name = layer_tmp_name[layer_start_pos:-2].lower()
> 
> KeyError: 'aliastypes'

am I missing something?

Scapy changed API

where can I upload code to a json file? I'm uneducated in this department