QuestionQ11

Packet Analysis with Python

A log file is held in variable a. Each log entry has the following big-endian format, in this order:

  • Field 1: 2-byte integer -
  • Field 2: 2-byte integer -
  • Field 3: 4-byte integer -

Which of the following unpacks a line from the log file into the correct fields?

  • A struct.unpack('>HH4s',a)
  • B struct.unpack('<HHssss',a)
  • C struct.unpack('>HHHH',a)
  • D struct.unpack('!BxBx4s',a)
Explanation

The > prefix selects big-endian byte order, and each H decodes a standard 2-byte unsigned integer. 4s consumes the remaining four bytes as one field, so >HH4s is the only available format that preserves the required 2-byte, 2-byte, and 4-byte boundaries. Strictly, decoding the final field as an integer would require a four-byte integer format such as I or i; that format is not offered. The Python struct documentation defines > as big-endian, H as a 2-byte unsigned short, and s with a count as a byte string of that length.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!