PKT(3)

💖 PKT 💖 (that's the pkt 1.4 manual, bestie)

okay so welcome to the PKT(3) page, aka the place where packets get a whole entire glow-up. Pull up a chair, grab a strawberry 🍓, and let's get into it.

---

✨ NAME ✨

packet.pkt — the Pkt module. that's it, that's the name 🎀

---

🌸 DESCRIPTION 🌸

It gives you the object for a packet plus the string representation of the packet. And here's the iconic part: this object has an attribute for each of the layers in the packet, so you can reach every layer directly instead of digging through them one by one. Like, to get at the nfs layer object you just go x.nfs instead of doing the whole x.ethernet.ip.tcp.rpc.nfs hike, which would be genuinely so cumbersome to use. Also — and this is the real reason — since NFS can run over either TCP or UDP, accessing the nfs object independently of the protocol would otherwise be way harder. slay. 💅

🦋 Packet object attributes:

Pkt(
    record   = Record information (frame number, etc.)
    ethernet = ETHERNET II (RFC 894) object
    ip       = IPv4 object
    tcp      = TCP object
    rpc      = RPC object
    nfs      = NFS object
)

---

👑 CLASSES 👑

🌈 class Pkt(baseobj.BaseObj)

the packet object, the moment, the main character ⭐

Usage:

from packet.pkt import Pkt

x = Pkt()

# Check if this is an NFS packet
if x == 'nfs':
    print x.nfs

🧚 Methods defined here:

---

• __eq__(self, other) — the comparison method, used to figure out if the object has a given layer. vibe check, but for layers ✨
• __init__(self) — the constructor 🎀

It initializes the object's private data according to the arguments you gave it. And ngl, arguments can be positional, named, or a mix of both — your call, bestie.

• __ne__(self, other) — the comparison method used to figure out if the object does NOT have a given layer 💀
• __repr__(self) — the formal string representation of the packet object
• __str__(self) — the string representation of the object

Important: the representation depends on the verbose level set by debug_repr().

If it's set to 0, you get the generic object representation.

If it's set to 1, the representation is condensed into a single line. It contains the frame number, IP source and destination and/or the last layer:

'1 0.386615 192.168.0.62 -> 192.168.0.17 TCP 2049 -> 708, seq: 3395733180, ack: 3294169773, ACK,SYN'
'5 0.530957 00:0c:29:54:09:ef -> ff:ff:ff:ff:ff:ff, type: 0x806'
'19 0.434370 192.168.0.17 -> 192.168.0.62 NFS v4 COMPOUND4 call  SEQUENCE;PUTFH;GETATTR'

If it's set to 2, the representation of the object is a line for each layer:

'Pkt(
     RECORD:   frame 19 @ 0.434370 secs, 238 bytes on wire, 238 bytes captured
     ETHERNET: 00:0c:29:54:09:ef -> e4:ce:8f:58:9f:f4, type: 0x800(IPv4)
     IP:       192.168.0.17 -> 192.168.0.62, protocol: 6(TCP), len: 224
     TCP:      src port 708 -> dst port 2049, seq: 3294170673, ack: 3395734137, len: 172, flags: ACK,PSH
     RPC:      CALL(0), program: 100003, version: 4, procedure: 1, xid: 0x1437d3d5
     NFS:      COMPOUND4args(tag='', minorversion=1, argarray=[nfs_argop4(argop=OP_SEQUENCE, ...), ...])
 )'

• add_layer(self, name, layer) — adds a layer to name and the object to the packet. lowkey essential 🫶
• get_layers(self) — returns the list of layers currently chillin' in the packet 🌸

---

🔥 SEE ALSO 🔥

baseobj(3) — go read that one too, iykyk 💜

---

💀 BUGS 💀

No known bugs. (we ate and left no crumbs 😌✨)

---

🎀 AUTHOR 🎀

Jorge Mora (mora@netapp.com) — thank you for your service, king 👑

---

bestie this is NFStest 3.2, dated 21 March 2023 — periodt. go capture some packets, you got this 💅🦋🌸