Scapy's NBytesField endianness

Question

I"m making some new protocol that requires a 12-byte integer field. I cant find any information regarding the endianness of this field or some example of what this field is designed for.

class TestClass(Packet):
    name = "test"
    fields_desc = [
        NBytesField("data", 0, 12)  #12 byte long with 0 as default
    ]

a=TestClass(data=0x8)
a.show2()
###[ test ]### 
  data      = 2475880078570760549798248448

Raw(a) gives me what I expect, data as integer in big-endian.

raw(a)
>>> b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08'

a.data also gives me correct value:

>>> a.data
8

So the packet is created with data field in big-endian which is correct and that's exactly what I want.

However when decoding a raw packet, it gives me wrong integer value.

>>> b=TestClass(raw(a))
>>> raw(b)
b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08'
>>> b.data
2475880078570760549798248448

I can do some manipulation to convert it back.

But it's seems strange that scapy encodes it with big-endian but then decodes it with little endian.

It's just super weird. I don't know what I'm missing here.

Thanks a lot!!!

I don't have any problems if data is IntField

Scapy's NBytesField endianness

0 Answers