title: Parsing ip address with dpkt
body: <p>I am using dpkt to parse a pcap file, however I am confused about how to extract the destination ip address. I am parsing the packets using <code>eth = dpkt.ethernet.Ethernet(buf)</code> which returns an ethernet object which looks like the following:</p>
  
  <pre><code>Ethernet(src='\x00\x1a\xa0kUf', dst='\x00\x13I\xae\x84,', data=IP(src='\xc0\xa8\n\n',
  off=16384, dst='C\x17\x030', sum=25129, len=52, p=6, id=51105, data=TCP(seq=9632694,
  off_x2=128, ack=3382015884, win=54, sum=65372, flags=17, dport=80, sport=56145)))
  </code></pre>
  
  <p>I am confused about 2 things.</p>
  
  <ol>
  <li>Should I be grabbing the dst field in Ethernet, or the one in IP (Ethernet.data)?</li>
  <li>How can I turn these weird strings into ip addresses of the form x.x.x.x where x is an integer from 0-255?</li>
  </ol>
  
  <p>I tried a solution like <a href="https://stackoverflow.com/questions/2197974/convert-little-endian-hex-string-to-ip-address-in-python">Convert &quot;little endian&quot; hex string to IP address in Python</a>, but both dst fields seem to sometimes contain data which seemingly cannot be parsed to an ip address such as <code>_daQ</code> (how is _daQ parsed to address?) or <code>RT\x00\x125\x02</code> (what is RT?) or <code>33\x00\x01\x00\x03</code> (what is the 33 at the beginning and why does this look like 5 bytes not 4?) </p>