How can I extract plain text from a packet Hex dump?

Question

I'm using pycapy and Impacket to write a script that records and analyzes network traffic. The output looks like this:

Ether: 00:1b:21:50:aa:b2 -> 00:25:11:2c:12:56
IP DF xxx.xxx.xxx.xx1 -> xxx.xxx.xxx.xx1 
TCP ack push 17500 -> 49669

1703 0100 207e 7f37 25c0 59c2 b263 2071    .... ~.7%.Y..c q
16be 9382 18b2 b1c5 dedc 6c1b 2b21 fbc1    ..........l.+!..
4ae1 4c20 d117 0301 0020 a223 76b9 1ec3    J.L ..... .#v...
e8b6 c229 cf65 85ed c9e4 0e3f 337f d1ae    ...).e.....?3...
7ca8 5a5f 0627 dcc4 9d71                   |.Z_.'...q

Ether: 00:1b:21:50:aa:b2 -> 00:25:11:2c:12:56
IP DF xxx.xxx.xxx.xx1 -> xxx.xxx.xxx.xx1 
TCP ack push 17500 -> 49669

1703 0100 2096 698d db90 b9ae 9fc2 bfb3    .... .i.........
8cfd dedb 6105 0ada 5e7a b160 ee63 500f    ....a...^z.`.cP.
a373 51cc 0917 0301 0020 d745 e4f4 6b5f    .sQ...... .E..k_
66b9 945d 8456 63fe 87ed 2584 ead2 1e98    f..].Vc...%.....
c3de 0003 2405 52fc dd06                   ....$.R...

Ether: 00:25:11:2c:12:56 -> 00:1b:21:50:aa:b2
IP DF xxx.xxx.xxx.xx1 -> xxx.xxx.xxx.xx1
TCP ack 49669 -> 17500

Ether: 00:25:11:2c:12:56 -> 00:1b:21:50:a3:13
IP DF xxx.xxx.xxx.xx1 -> xxx.xxx.xxx.xx1
TCP ack push 49670 -> 17500

1703 0100 2021 ad5a bc41 7ef3 e008 1130    .... !.Z.A~....0
29c1 9439 6e06 0792 6511 ec5e 6520 eb50    )..9n...e..^e .P
7f9d 1647 0117 0301 0030 b2ee 0b08 f0c1    ...G.....0......
cc97 dccb a206 a52b 3065 92c0 2c7f 6e54    .......+0e..,.nT
b75c 1905 d93f fb46 0d9c 0742 7a04 3648    .\...?.F...Bz.6H
556f dbb1 09c1 e636 60ad                   Uo.....6`.

What I want to do is extract the data out of this, specifically the TCP WindowFull and ZeroWindow. How would I go about turning these hex dumps in to plain text so they can be fed back in to Python for analysis? I don't want to use WireShark because I'm trying to make a standalone application.

Answer 1

To follow up on a_hex_string.decode('hex'), here's an example.

In [26]: s = 'stackoverflow'

In [27]: t = s.encode('hex')

In [28]: t
Out[28]: '737461636b6f766572666c6f77'

In [29]: t.decode('hex')
Out[29]: 'stackoverflow'