How to create a custom top-level layer 2 header in scapy?

Question

Say I have the following:

class Delimiter(Packet):
    name = "Delimiter"
    fields_desc = [
        ByteField("val", 0)
    ]

class OutHeader(Packet):
    name = "Out Header"
    fields_desc = [
        ShortField("index", 0)
    ]

bind_layers(Delimiter, OutHeader, val=0)
bind_layers(OutHeader, Ether)

And I want to make Delimeter a layer 2 header, such that there is no Ether header at the top of the packet. How can I do this? With just this code, Scapy reads this instead:

###[ 802.3 ]###
  dst       = 00:51:99:ff:ff:ff
  src       = ff:ff:ff:00:00:00
  len       = 0
###[ Padding ]###

I think you are confusing the network layers. Packets are layer-3, which are the payload of layer-2 (e.g. ethernet) frames. — Ron Maupin
@RonMaupin Thanks for the response. No, I am referring to my observation that Scapy seems to start dissecting packets at Layer 2, but I don't know how to define a layer such as Ether, Dot3, etc. at the front of the packet. — rosstex
You do not do that. The data-link layer is defined by the interface and driver. You cannot, for example, send token-ring frames on an ethernet interface, or vice versa. There is no field for the frame type the way that the frame has an EtherType, or the packet has a Protocol field, etc. — Ron Maupin
@RonMaupin I suppose that is the case. Still, note the raw bytes of the packet. 00 is clearly the delimeter, 51:99 is clearly the Out Header and ff:.... is the destination MAC. I just want to parse the packet in that format. — rosstex
For ethernet, there is a seven-octet Synchronization (alternating ones and zeros), then a one-octet Start-of-Frame delimiter (alternating ones and zeros until the last bit, which is also one, making two ones in a row), then the frame starts with the destination MAC address. Also, at the end of the frame, there is a 12-octet igap of silence on the line That is how an ethernet frame is delimited. There is not 00 frame delimiter. The frame starts immediately after the 11 in the SoF. Other data-link protocols do it differently. — Ron Maupin

rosstex rosstex · Accepted Answer · 2019-09-06T18:58:29

I eventually solved the problem by manually slicing off the headers, without custom Packet objects:

s = str(pkt).encode("hex")
delim = int(s[:2])
index = int(s[2:6], 16)
rest = Ether(s[6:].decode("hex"))

How to create a custom top-level layer 2 header in scapy?

1 Answers