# 解析 IP 头部示例
import struct

def parse_ip_header(data):
    """解析 IP 头部"""
    if len(data) < 20:
        return None
    
    # 解析前 20 字节
    fields = struct.unpack('!BBHHHBBHII', data[:20])
    
    version = fields[0] >> 4
    ihl = fields[0] & 0xF
    ttl = fields[5]
    protocol = fields[6]
    src_ip = struct.pack('!I', fields[8])
    dst_ip = struct.pack('!I', fields[9])
    
    import socket
    return {
        'version': version,
        'header_length': ihl * 4,
        'ttl': ttl,
        'protocol': protocol,  # 6=TCP, 17=UDP
        'src_ip': socket.inet_ntoa(src_ip),
        'dst_ip': socket.inet_ntoa(dst_ip)
    }

import ipaddress

def subnet_info(network_str):
    """获取子网信息"""
    network = ipaddress.ip_network(network_str, strict=False)
    
    return {
        'network_address': str(network.network_address),
        'broadcast_address': str(network.broadcast_address),
        'netmask': str(network.netmask),
        'prefix_len': network.prefixlen,
        'total_hosts': network.num_addresses,
        'usable_hosts': network.num_addresses - 2 if network.prefixlen < 31 else network.num_addresses,
        'first_host': str(network.network_address + 1),
        'last_host': str(network.broadcast_address - 1)
    }

# 示例
print(subnet_info('192.168.1.0/24'))
# {'network_address': '192.168.1.0', 'broadcast_address': '192.168.1.255',
#  'netmask': '255.255.255.0', 'prefix_len': 24, 'total_hosts': 256,
#  'usable_hosts': 254, 'first_host': '192.168.1.1', 'last_host': '192.168.1.254'}

# 查看路由表
$ ip route show
default via 192.168.1.1 dev eth0 
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100 
10.0.0.0/8 via 192.168.1.254 dev eth0

def analyze_fragments():
    """分片示例分析"""
    original_size = 4000  # 原始数据包大小
    mtu = 1500            # 链路 MTU
    ip_header = 20        # IP 头部大小
    max_data = mtu - ip_header  # 每片最大数据 = 1480
    
    fragments = []
    offset = 0
    remaining = original_size - ip_header  # 3980 字节数据
    
    while remaining > 0:
        frag_data = min(remaining, max_data)
        mf = 1 if remaining > max_data else 0
        
        fragments.append({
            'offset': offset,
            'data_size': frag_data,
            'MF': mf,
            'total_size': frag_data + ip_header
        })
        
        offset += frag_data
        remaining -= frag_data
    
    return fragments

for frag in analyze_fragments():
    print(f"分片: offset={frag['offset']:5d}, size={frag['data_size']:5d}, MF={frag['MF']}")
# 分片: offset=    0, size= 1480, MF=1
# 分片: offset= 1480, size= 1480, MF=1
# 分片: offset= 2960, size= 1020, MF=0

# ping 使用 ICMP Echo
$ ping -c 3 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=118 time=12.3 ms

# traceroute 使用 TTL 超时
$ traceroute 8.8.8.8
 1  192.168.1.1 (192.168.1.1)  1.234 ms
 2  10.0.0.1 (10.0.0.1)  5.678 ms
 ...

# 查看 ARP 缓存
$ arp -a
? (192.168.1.1) at 00:11:22:33:44:55 [ether] on eth0
? (192.168.1.2) at 66:77:88:99:aa:bb [ether] on eth0