title: reading sent and received SYS and ACK packets with dpkt and python
body: <p>I need to parse a .pcap file to detect possible SYS scans. I need to be able to display the IP address of any IP addresses that sent 3 times as many SYS packets as the number of SYS+ACK packets they received. Now I have a general idea of how to implement this. My issue is that I do not how to get the different SYS packets (how to differentiate from the sent/received packets) when parsing the pcap file. I have looked at other posts, and the <a href="http://www.commercialventvac.com/dpkt.html#mozTocId147538" rel="nofollow">documentation</a> but have been unlucky. </p>
  
  <p>I started a python program that starts a bit like this: </p>
  
  <pre><code>import dptk
  
      //take in command line arguement
      file = arg
  
          openFile = open(file)
          pcap = dpkt.pcap.Reader(openFile)
  
      //not sure about these two lines
          syn_flag = ( tcp.flags &amp; dpkt.tcp.TH_SYN ) != 0       
          ack_flag = ( tcp.flags &amp; dpkt.tcp.TH_ACK ) != 0
  </code></pre>
  
  <p>When I call those last two lines, am I getting all SYS and all ACK packets from the pcap? How do I tell which have been sent/received?</p>