def _PPIGuessPayloadClass(p, **kargs):
    """ This function tells the PacketListField how it should extract the
        TLVs from the payload.  We pass cls only the length string
        pfh_len says it needs.  If a payload is returned, that means
        part of the string was unused.  This converts to a Raw layer, and
        the remainder of p is added as Raw's payload.  If there is no
        payload, the remainder of p is added as out's payload.
    """
    if len(p) >= 4:
        t, pfh_len = struct.unpack("<HH", p[:4])
        # Find out if the value t is in the dict _ppi_types.
        # If not, return the default TLV class
        cls = getPPIType(t, "default")
        pfh_len += 4
        out = cls(p[:pfh_len], **kargs)
        if (out.payload):
            out.payload = conf.raw_layer(out.payload.load)
            out.payload.underlayer = out
            if (len(p) > pfh_len):
                out.payload.payload = conf.padding_layer(p[pfh_len:])
                out.payload.payload.underlayer = out.payload
        elif (len(p) > pfh_len):
            out.payload = conf.padding_layer(p[pfh_len:])
            out.payload.underlayer = out
    else:
        out = conf.raw_layer(p, **kargs)
    return out

 def getfield(self, pkt, s):
     c = l = None
     if self.length_from is not None:
         l = self.length_from(pkt)
     elif self.count_from is not None:
         c = self.count_from(pkt)
         
     lst = []
     ret = ""
     remain = s
     if l is not None:
         remain,ret = s[:l],s[l:]
     while remain:
         if c is not None:
             if c <= 0:
                 break
             c -= 1
         try:
             p = self.m2i(pkt,remain)
         except Exception:
             if conf.debug_dissector:
                 raise
             p = conf.raw_layer(load=remain)
             remain = ""
         else:
             if conf.padding_layer in p:
                 pad = p[conf.padding_layer]
                 remain = pad.load
                 del(pad.underlayer.payload)
             else:
                 remain = ""
         lst.append(p)
     return remain+ret,lst

    def recv(self, x=MTU):
        pkt, sa_ll = self.ins.recvfrom(x)
        if sa_ll[2] == socket.PACKET_OUTGOING:
            return None
        if sa_ll[3] in conf.l2types:
            cls = conf.l2types[sa_ll[3]]
            lvl = 2
        elif sa_ll[1] in conf.l3types:
            cls = conf.l3types[sa_ll[1]]
            lvl = 3
        else:
            cls = conf.default_l2
            warning(" Impossivel saber o tipo (interface=%s protocol=%#x familia=%i). Usando %s" % (sa_ll[0],sa_ll[1],sa_ll[3],cls.name))
            lvl = 2

        try:
            pkt = cls(pkt)
        except KeyboardInterrupt:
            raise
        except:
            if conf.debug_dissector:
                raise
            pkt = conf.raw_layer(pkt)
        if lvl == 2:
            pkt = pkt.payload
            
        if pkt is not None:
            pkt.time = get_last_packet_timestamp(self.ins)
        return pkt

    def recv(self, x=MTU):
        pkt, sa_ll = self.ins.recvfrom(x)
        if sa_ll[2] == socket.PACKET_OUTGOING:
            return None
        if sa_ll[3] in conf.l2types:
            cls = conf.l2types[sa_ll[3]]
            lvl = 2
        elif sa_ll[1] in conf.l3types:
            cls = conf.l3types[sa_ll[1]]
            lvl = 3
        else:
            cls = conf.default_l2
            warning("Unable to guess type (interface=%s protocol=%#x family=%i). Using %s", sa_ll[0], sa_ll[1], sa_ll[3], cls.name)  # noqa: E501
            lvl = 3

        try:
            pkt = cls(pkt)
        except KeyboardInterrupt:
            raise
        except Exception:
            if conf.debug_dissector:
                raise
            pkt = conf.raw_layer(pkt)
        if lvl == 2:
            pkt = pkt.payload

        if pkt is not None:
            from scapy.arch import get_last_packet_timestamp
            pkt.time = get_last_packet_timestamp(self.ins)
        return pkt

        def recv(self, x=MTU):
            ll = self.ins.datalink()
            if ll in conf.l2types:
                cls = conf.l2types[ll]
            else:
                cls = conf.default_l2
                warning(
                    "Unable to guess datalink type (interface=%s linktype=%i). Using %s" % (self.iface, ll, cls.name)
                )

            pkt = self.ins.next()
            if pkt is not None:
                ts, pkt = pkt
            if pkt is None:
                return

            try:
                pkt = cls(pkt)
            except KeyboardInterrupt:
                raise
            except:
                if conf.debug_dissector:
                    raise
                pkt = conf.raw_layer(pkt)
            pkt.time = ts
            return pkt

 def m2i(self, pkt, m):
     ret = None
     eap_packet_len = struct.unpack("!H", m[2:4])[0]
     if eap_packet_len < 254:
         # If the EAP packet has not been fragmented, build a Scapy EAP
         # packet from the data.
         ret = EAP(m)
     else:
         ret = conf.raw_layer(m)
     return ret

 def do_dissect_payload(self, s):
     if s:
         try:
             p = SSLv2(s, _internal=1, _underlayer=self,
                       tls_session = self.tls_session)
         except KeyboardInterrupt:
             raise
         except:
             p = conf.raw_layer(s, _internal=1, _underlayer=self)
         self.add_payload(p)

 def __div__(self, other):
     if isinstance(other, Packet):
         cloneA = self.copy()
         cloneB = other.copy()
         cloneA.add_payload(cloneB)
         return cloneA
     elif type(other) is str:
         return self/conf.raw_layer(load=other)
     else:
         return other.__rdiv__(self)

 def recv(self, x=MTU):
     pkt, sa_ll = self.ins.recvfrom(x)
     if sa_ll[2] == socket.PACKET_OUTGOING:
         return None
     try:
         q = self.LL(pkt)
     except KeyboardInterrupt:
         raise
     except:
         if conf.debug_dissector:
             raise
         q = conf.raw_layer(pkt)
     q.time = get_last_packet_timestamp(self.ins)
     return q

 def read_packet(self, size=MTU):
     rp = RawPcapNgReader.read_packet(self, size=size)
     if rp is None:
         return None
     s, (linktype, sec, usec, wirelen) = rp
     try:
         p = conf.l2types[linktype](s)
     except KeyboardInterrupt:
         raise
     except:
         if conf.debug_dissector:
             raise
         p = conf.raw_layer(s)
     p.time = sec+0.000001*usec
     return p

 def do_dissect_payload(self, s):
     """
     Try to dissect the following data as a TLS message.
     Note that overloading .guess_payload_class() would not be enough,
     as the TLS session to be used would get lost.
     """
     if s:
         try:
             p = TLS(s, _internal=1, _underlayer=self,
                     tls_session = self.tls_session)
         except KeyboardInterrupt:
             raise
         except:
             p = conf.raw_layer(s, _internal=1, _underlayer=self)
         self.add_payload(p)

 def read_packet(self, size=MTU):
     rp = RawPcapReader.read_packet(self, size=size)
     if rp is None:
         return None
     s,(sec,usec,wirelen) = rp
     
     try:
         p = self.LLcls(s)
     except KeyboardInterrupt:
         raise
     except:
         if conf.debug_dissector:
             raise
         p = conf.raw_layer(s)
     p.time = sec + (0.000000001 if self.nano else 0.000001) * usec
     return p

 def do_dissect_payload(self, s):
     if s:
         cls = self.guess_payload_class(s)
         try:
             p = cls(s, _internal=1, _underlayer=self)
         except KeyboardInterrupt:
             raise
         except:
             if conf.debug_dissector:
                 if isinstance(cls,type) and issubclass(cls,Packet):
                     log_runtime.error("%s dissector failed" % cls.name)
                 else:
                     log_runtime.error("%s.guess_payload_class() returned [%s]" % (self.__class__.__name__,repr(cls)))
                 if cls is not None:
                     raise
             p = conf.raw_layer(s, _internal=1, _underlayer=self)
         self.add_payload(p)

 def add_payload(self, payload):
     if payload is None:
         return
     elif not isinstance(self.payload, NoPayload):
         self.payload.add_payload(payload)
     else:
         if isinstance(payload, Packet):
             self.payload = payload
             payload.add_underlayer(self)
             for t in self.aliastypes:
                 if payload.overload_fields.has_key(t):
                     self.overloaded_fields = payload.overload_fields[t]
                     break
         elif type(payload) is str:
             self.payload = conf.raw_layer(load=payload)
         else:
             raise TypeError("payload must be either 'Packet' or 'str', not [%s]" % repr(payload))

def __gen_send(s, x, inter=0, loop=0, count=None, verbose=None, realtime=None, return_packets=False, *args, **kargs):
    if isinstance(x, str):
        x = conf.raw_layer(load=x)
    if not isinstance(x, Gen):
        x = SetGen(x)
    if verbose is None:
        verbose = conf.verb
    n = 0
    if count is not None:
        loop = -count
    elif not loop:
        loop = -1
    if return_packets:
        sent_packets = plist.PacketList()
    try:
        while loop:
            dt0 = None
            for p in x:
                if realtime:
                    ct = time.time()
                    if dt0:
                        st = dt0+p.time-ct
                        if st > 0:
                            time.sleep(st)
                    else:
                        dt0 = ct-p.time
                s.send(p)
                if return_packets:
                    sent_packets.append(p)
                n += 1
                if verbose:
                    os.write(1,".")
                time.sleep(inter)
            if loop < 0:
                loop += 1
    except KeyboardInterrupt:
        pass
    s.close()
    if verbose:
        print("\nSent %i packets." % n)
    if return_packets:
        return sent_packets

    def recv(self, x=MTU):
        pkt, sa_ll = self.ins.recvfrom(x)
        if sa_ll[3] in conf.l2types :
            cls = conf.l2types[sa_ll[3]]
        elif sa_ll[1] in conf.l3types:
            cls = conf.l3types[sa_ll[1]]
        else:
            cls = conf.default_l2
            warning("Unable to guess type (interface=%s protocol=%#x family=%i). Using %s" % (sa_ll[0],sa_ll[1],sa_ll[3],cls.name))

        try:
            pkt = cls(pkt)
        except KeyboardInterrupt:
            raise
        except:
            if conf.debug_dissector:
                raise
            pkt = conf.raw_layer(pkt)
        pkt.time = get_last_packet_timestamp(self.ins)
        return pkt

    def extract_frames(self, bpf_buffer):
        """Extract all frames from the buffer and stored them in the received list."""  # noqa: E501

        # Ensure that the BPF buffer contains at least the header
        len_bb = len(bpf_buffer)
        if len_bb < 20:  # Note: 20 == sizeof(struct bfp_hdr)
            return

        # Extract useful information from the BPF header
        if FREEBSD or NETBSD:
            # struct bpf_xhdr or struct bpf_hdr32
            bh_tstamp_offset = 16
        else:
            # struct bpf_hdr
            bh_tstamp_offset = 8

        # Parse the BPF header
        bh_caplen = struct.unpack('I', bpf_buffer[bh_tstamp_offset:bh_tstamp_offset + 4])[0]  # noqa: E501
        next_offset = bh_tstamp_offset + 4
        bh_datalen = struct.unpack('I', bpf_buffer[next_offset:next_offset + 4])[0]  # noqa: E501
        next_offset += 4
        bh_hdrlen = struct.unpack('H', bpf_buffer[next_offset:next_offset + 2])[0]  # noqa: E501
        if bh_datalen == 0:
            return

        # Get and store the Scapy object
        frame_str = bpf_buffer[bh_hdrlen:bh_hdrlen + bh_caplen]
        try:
            pkt = self.guessed_cls(frame_str)
        except Exception:
            if conf.debug_dissector:
                raise
            pkt = conf.raw_layer(frame_str)
        self.received_frames.append(pkt)

        # Extract the next frame
        end = self.bpf_align(bh_hdrlen, bh_caplen)
        if (len_bb - end) >= 20:
            self.extract_frames(bpf_buffer[end:])

#.........这里部分代码省略.........
                # Determine first timestamp.
                if uptime is not None:
                    ts_a = uptime
                elif ts_hint[0] and 0 < ts_hint[0] < 2**32:
                    # Note: if first ts is 0, p0f registers it as "T0" not "T",
                    # hence we don't want to use the hint if it was 0.
                    ts_a = ts_hint[0]
                else:
                    ts_a = random.randint(120, 100 * 60 * 60 * 24 * 365)
                # Determine second timestamp.
                if 'T' not in pers[5]:
                    ts_b = 0
                elif ts_hint[1] and 0 < ts_hint[1] < 2**32:
                    ts_b = ts_hint[1]
                else:
                    # FIXME: RandInt() here does not work (bug (?) in
                    # TCPOptionsField.m2i often raises "OverflowError:
                    # long int too large to convert to int" in:
                    #    oval = struct.pack(ofmt, *oval)"
                    # Actually, this is enough to often raise the error:
                    #    struct.pack('I', RandInt())
                    ts_b = random.randint(1, 2**32 - 1)
                options.append(('Timestamp', (ts_a, ts_b)))
            elif opt == 'S':
                options.append(('SAckOK', ''))
            elif opt == 'N':
                options.append(('NOP', None))
            elif opt == 'E':
                options.append(('EOL', None))
            elif opt[0] == '?':
                if int(opt[1:]) in TCPOptions[0]:
                    optname = TCPOptions[0][int(opt[1:])][0]
                    optstruct = TCPOptions[0][int(opt[1:])][1]
                    options.append((optname,
                                    struct.unpack(optstruct,
                                                  RandString(struct.calcsize(optstruct))._fix())))  # noqa: E501
                else:
                    options.append((int(opt[1:]), ''))
            # FIXME: qqP not handled
            else:
                warning("unhandled TCP option " + opt)
            pkt.payload.options = options

    # window size
    if pers[0] == '*':
        pkt.payload.window = RandShort()
    elif pers[0].isdigit():
        pkt.payload.window = int(pers[0])
    elif pers[0][0] == '%':
        coef = int(pers[0][1:])
        pkt.payload.window = coef * RandNum(min=1, max=(2**16 - 1) // coef)
    elif pers[0][0] == 'T':
        pkt.payload.window = mtu * int(pers[0][1:])
    elif pers[0][0] == 'S':
        # needs MSS set
        mss = [x for x in options if x[0] == 'MSS']
        if not mss:
            raise Scapy_Exception("TCP window value requires MSS, and MSS option not set")  # noqa: E501
        pkt.payload.window = mss[0][1] * int(pers[0][1:])
    else:
        raise Scapy_Exception('Unhandled window size specification')

    # ttl
    pkt.ttl = pers[1] - extrahops
    # DF flag
    pkt.flags |= (2 * pers[2])
    # FIXME: ss (packet size) not handled (how ? may be with D quirk
    # if present)
    # Quirks
    if pers[5] != '.':
        for qq in pers[5]:
            # FIXME: not handled: P, I, X, !
            # T handled with the Timestamp option
            if qq == 'Z':
                pkt.id = 0
            elif qq == 'U':
                pkt.payload.urgptr = RandShort()
            elif qq == 'A':
                pkt.payload.ack = RandInt()
            elif qq == 'F':
                if db == p0fo_kdb:
                    pkt.payload.flags |= 0x20  # U
                else:
                    pkt.payload.flags |= random.choice([8, 32, 40])  # P/U/PU
            elif qq == 'D' and db != p0fo_kdb:
                pkt /= conf.raw_layer(load=RandString(random.randint(1, 10)))  # XXX p0fo.fp  # noqa: E501
            elif qq == 'Q':
                pkt.payload.seq = pkt.payload.ack
            # elif qq == '0': pkt.payload.seq = 0
        # if db == p0fr_kdb:
        # '0' quirk is actually not only for p0fr.fp (see
        # packet2p0f())
    if '0' in pers[5]:
        pkt.payload.seq = 0
    elif pkt.payload.seq == 0:
        pkt.payload.seq = RandInt()

    while pkt.underlayer:
        pkt = pkt.underlayer
    return pkt

    def post_dissect(self, data):
        """dissect the IPv6 package compressed into this IPHC packet.

        The packet payload needs to be decompressed and depending on the
        arguments, several conversions should be done.
        """

        # uncompress payload
        packet = IPv6()
        packet.version = IPHC_DEFAULT_VERSION
        packet.tc, packet.fl = self._getTrafficClassAndFlowLabel()
        if not self.nh:
            packet.nh = self._nhField
        # HLIM: Hop Limit
        if self.hlim == 0:
            packet.hlim = self._hopLimit
        elif self.hlim == 0x1:
            packet.hlim = 1
        elif self.hlim == 0x2:
            packet.hlim = 64
        else:
            packet.hlim = 255
        # TODO: Payload length can be inferred from lower layers from either the  # noqa: E501
        # 6LoWPAN Fragmentation header or the IEEE802.15.4 header

        packet.src = self.decompressSourceAddr(packet)
        packet.dst = self.decompressDestinyAddr(packet)

        if self.nh == 1:
            # The Next Header field is compressed and the next header is
            # encoded using LOWPAN_NHC

            udp = UDP()
            if self.header_compression and \
               self.header_compression & 0x4 == 0x0:
                udp.chksum = self.udpChecksum

            s, d = nhc_port(self)
            if s == 16:
                udp.sport = self.udpSourcePort
            elif s == 8:
                udp.sport = 0xF000 + s
            elif s == 4:
                udp.sport = 0xF0B0 + s
            if d == 16:
                udp.dport = self.udpDestinyPort
            elif d == 8:
                udp.dport = 0xF000 + d
            elif d == 4:
                udp.dport = 0xF0B0 + d

            packet.payload = udp / data
            data = raw(packet)
        # else self.nh == 0 not necessary
        elif self._nhField & 0xE0 == 0xE0:  # IPv6 Extension Header Decompression  # noqa: E501
            warning('Unimplemented: IPv6 Extension Header decompression')  # noqa: E501
            packet.payload = conf.raw_layer(data)
            data = raw(packet)
        else:
            packet.payload = conf.raw_layer(data)
            data = raw(packet)

        return Packet.post_dissect(self, data)

 def recv(self, x=MTU):
     return conf.raw_layer(self.ins.recv(x))