如何使用scapy或者别的工具解析过UDP-encapsulated ESP messages

land_litao

有同学使用scapy或者别的工具解析过UDP-encapsulated ESP messages没，就像下图这个wireshark消息，写了个测试程序，解析出来和wireshark里的不一样。

1. import scapy
   
2. from scapy.all import *
   
3. from scapy.utils import PcapReader
   
4. from Crypto.Cipher import AES
   
5. 
   
6. packets=rdpcap(r"tcpdump_NTLog_V2_2022_0314_190713_start_1.cap")
   
7. 
   
8. sa = SecurityAssociation(ESP,
   
9.                          spi=0x8610c449)
   
10. 
    
11. # C:\Users\[username]\AppData\Roaming\Wireshark\esp_sa
    
12. # "IPv4","192.168.2.72","207.219.233.33","0x8610c449","AES-CBC [RFC3602]","0x0bca0574cba28f949390a552cfbd8605","HMAC-SHA-1-96 [RFC2404]","0x6f8f7a3044fdc68dfa50c70c91bcb306fa6e1952"
    
13. res = CRYPT_ALGOS['AES-CBC'].decrypt(sa, packets[239][ESP], b'0bca0574cba28f949390a552cfbd8605', icv_size=12)
    
14. print(f'res.iv lenght is {len(res.iv)}')
    
15. for i in res.data:
    
16.     print(hex(i))
    
17.     break
    
18. 
    
19. res.show()

复制代码