need documentation and more example code about dpkt HOT 13 OPEN

Hey, is it just a consequence of relocation to Google code or dpkt really has 
no 
docs? It's a pitty, I'm just looking for good packet creation/sniffing tool 
that can
be extended easily. So there ar scapy and dpkt - one with docs, another without 
them.
Yeah, I know, look into sources works great...

I don't expect anything big. Just few words, its years already. Thanks.

i have to apologize for this - most code i host at googlecode these days is just
stuff i've written for myself, and wanted to share - but not necessarily 
support.
horrible, i know, but i figure it's best to set expectations correctly here - 
i'm
much more slax0r than hax0r these days.

if you're looking for a good tool or framework to extend, scapy's the better 
choice.
if you're looking for a more minimalist (ahem) approach to roll your own from a 
set
of bare metal APIs, dpkt/dnet/pypcap might be useful.

maybe jono, yardley, or the other dpkt committers might have a better idea of 
what
docs to write. i know i'm not typical, or even correct, to think that a handful 
of
code examples should serve as enough to get by on, but it's how i rationalize my
total slacker behavior. years spent wandering in the Linux wilderness outside of
OpenBSD's carefully tended garden (that, and having a toddler :-) have left me
somewhat ragged, disheveled, and disinterested in the relative luxury of 
concise,
correct documentation for my own projects.

anyhow, this is all to say, you're quite right about all of this, and i thank 
you for
not totally kicking my ass about it. i humbly suggest you kick jono and 
yardley's
asses instead - they can take it, and you'll probably get better results.

While scapy definitely has better documentation, the codebase makes me want to 
gouge
my eyes out. :-)

I'd much prefer writing more example code than some sort of general 
documentation of
dpkt.  Once you understand the basis of dpkt from a few examples,
parsing/construction of any file/packet format is fairly uniform across the 
various
modules.

Anywho, if anyone has questions on how to use dpkt or parse/construct specific
formats, feel free to post them in an issue and I'm more than happy to answer 
your
questions and provide example code.  I'll see if I can whip up some basic 
tutorials
based on some various examples I've written over the years that may be useful 
for
learning to use dpkt.

Was dpkt made to compete with scapy?
If so, how would one match an HTTP Request to an HTTP Response using dpkt?
Also, TCP reconstruction?

While this isn't quite documentation, there's a number of simple tutorials 
using dpkt
that I've posted:

http://jon.oberheide.org/blog/2008/08/25/dpkt-tutorial-1-icmp-echo/
http://jon.oberheide.org/blog/2008/10/15/dpkt-tutorial-2-parsing-a-pcap-file/
http://jon.oberheide.org/blog/2008/12/20/dpkt-tutorial-3-dns-spoofing/
http://jon.oberheide.org/blog/2009/03/25/dpkt-tutorial-4-as-paths-from-mrt-bgp/

Regards,
Jon Oberheide

[deleted comment]

Jeff, your link appears to be down, can you please re-post?

I'm trying to create radius access request with dpkt, but I'm failing. Can 
somebody post any example?

[deleted comment]

At the risk of pissing off some very smart people who may be working on this 
already, I am trying to write some documentation on dpkt by reverse engineering 
the source code.  As I embark on this voyage of discovery, I am putting my 
comments in http://www.commercialventvac.com/dpkt.html.  I am also working on 
creating a library of packet captures to decode and sample software to decode 
them.


Jeff Silverman

Jeff, many thanks. You have saved my skull from several fractures resulting 
from contact with the wall. 

what didn't i understand please explain for dpkt