The Network Program Log Two (Scapy)

​
【Scapy】
【使用scapy处理数据包】

scapy的使用

from scapy.all import *
from scapy.layers.inet import *

pac = dir(scapy.layers)
print(pac)  #执行代码后，会输出Scapy中的各层

['builtins', 'cached', 'doc', 'file', 'loader', 'name', 'package', 'path', 'spec', 'all', 'bluetooth', 'bluetooth4LE', 'dcerpc', 'dhcp', 'dhcp6', 'dns', 'dot11', 'dot15d4', 'eap', 'gprs', 'gssapi', 'hsrp', 'inet', 'inet6', 'ipsec', 'ir', 'isakmp', 'kerberos', 'l2', 'l2tp', 'ldap', 'llmnr', 'lltd', 'mgcp', 'mobileip', 'mspac', 'netbios', 'netflow', 'ntlm', 'ntp', 'ppi', 'ppp', 'pptp', 'radius', 'rip', 'rtp', 'sctp', 'sixlowpan', 'skinny', 'smb', 'smb2', 'smbclient', 'smbserver', 'snmp', 'tftp', 'tls', 'vrrp', 'vxlan', 'x509', 'zigbee']

print(explore(scapy.layers.l2))  #查看各种二层协议

查看协议类的属性

在使用Scapy构造数据包时，需要填入数据包的字段，这些字段就是类的属性。Scapy目前使用频率比较高的类是Ether类、IP类、TCP类和UDP类。

可以使用 ls(类名) 函数来查看类拥有的属性，如果不带参数显示的是Scapy支持的协议类。

print(explore(scapy.packet.ls(Ether)))

print(explore(scapy.packet.ls(IP)))

print(explore(scapy.packet.ls(TCP)))

print(explore(scapy.packet.ls(UDP)))

构造数据包

Scapy具有强大的数据包构造功能，利用Scapy可以直观、灵活地构造各种数据包，甚至可以根据需要自定义网络协议。在构造数据包的时候，它遵循网络协议分层的思想，以参数化赋值的方式进行。

简单构造：

pkt = IP()/TCP()  #该包的结构包含IP部分和TCP部分

构造数据包：

pkt = IP(src="192.168.56.1",dst="192.168.56.100") /TCP()

Scapy 中的分层结构

OSI 模型中的下层协议在前，以/隔开

Ether()/IP()/TCP()

Ether 类用于设置发送方和接收方的 MAC 地址

构造 HTTP、ICMP 包

数据包的查看：

数据包发送：

---

WARNING: WinPcap is now deprecated (not maintained). Please use Npcap instead

Begin emission:

Finished sending 1 packets.

...*

Received 4 packets, got 1 answers, remaining 0 packets

IP / ICMP 192.168.56.1 > 192.168.56.100 echo-request 0 ==> IP / ICMP 192.168.56.100 > 192.168.56.1 echo-reply 0

数据包的接收：

响应状态:

常用函数：

过滤的语句：

host 192.168.1.1

dst host  192.168.1.1

src port 8080

以太网（MAC 地址）源地址或者目的地址为 11：22：33：44：55：66

ether host 11:22:33:44:55:66

源 MAC 为 11:22:33:44:55:66 的数据包

ether src 11:22:33:44:55:66

源地址在 192.168.1.0/24 网段的数据包

src net 192.168.1.0/24

还可以使用 and、or、not 组合过滤

host 192.168.1.1 and port 8080

在IP地址为192.168.56.1的主机上ping 192.168.56.100，抓取ICMP的报文并输出10个ICMP的报文：

from scapy.all import *
from scapy.layers.inet import *

from scapy.layers.inet6 import *

from scapy.all import sniff

print(dir(scapy.layers))

print(explore(scapy.packet.ls(Ether)))

print(explore(scapy.packet.ls(UDP)))

构造数据包，必须/分层

pkt = Ether(src="00:80:c2:00:00:14",dst="ff:ff:ff:ff:ff:ff")/IP(src="192.168.56.1",dst="192.168.56.100")/TCP()

pkt.show()

res = sr1(pkt)

res.show()

ls(pkt)

print(pkt.summary())

wrpcap("text.cap",pkt)

textcap = rdpcap("text.cap")

textcap.show()

print(conf.ifaces)

print(conf.route)

i = traceroute(["202.96.134.133"])

print(i)

pkt = IP(src="192.168.56.1",dst="192.168.56.100")/ICMP()

wrpcap("text2.cap",sr1(pkt))

def callback(pkt):
    print(pkt.summary)
    wrpcap("test.cap",pkt)

sniff(filter="icmp and 192.168.56.100",iface="VirtualBox Host-Only Ethernet Adapter #2",prn=callback,count=100)

导入 二三四 层方法

from scapy.all import *
from scapy.layers.inet6 import *

应用层

from scapy.layers.inet import *
print(dir(scapy.layers))

['builtins', 'cached', 'doc', 'file', 'loader', 'name', 'package', 'path', 'spec',

'all', 'bluetooth', 'bluetooth4LE', 'dcerpc', 'dhcp', 'dhcp6', 'dns', 'dot11', 'dot15d4', 'eap', 'gprs', 'gssapi',

'hsrp', 'inet', 'inet6', 'ipsec', 'ir', 'isakmp', 'kerberos', 'l2', 'l2tp', 'ldap', 'llmnr', 'lltd', 'mgcp', 'mobileip',

'mspac', 'netbios', 'netflow', 'ntlm', 'ntp', 'ppi', 'ppp', 'pptp', 'radius', 'rip', 'rtp', 'sctp', 'sixlowpan', 'skinny',

'smb', 'smb2', 'smbclient', 'smbserver', 'snmp', 'tftp', 'tls', 'vrrp', 'vxlan', 'x509', 'zigbee']

构造包时查看支持的报文(ipv4)：

print(explore(scapy.layers.inet))

Class |Name

--------------------------|-------------------------------------------

ICMP |ICMP

ICMPerror |ICMP in ICMP

IP |IP

IPOption |IP Option

IPOption_Address_Extension|IP Option Address Extension

IPOption_EOL |IP Option End of Options List

IPOption_LSRR |IP Option Loose Source and Record Route

IPOption_MTU_Probe |IP Option MTU Probe

IPOption_MTU_Reply |IP Option MTU Reply

IPOption_NOP |IP Option No Operation

IPOption_RR |IP Option Record Route

IPOption_Router_Alert |IP Option Router Alert

IPOption_SDBM |IP Option Selective Directed Broadcast Mode

IPOption_SSRR |IP Option Strict Source and Record Route

IPOption_Security |IP Option Security

IPOption_Stream_Id |IP Option Stream ID

IPOption_Timestamp |IP Option Timestamp

IPOption_Traceroute |IP Option Traceroute

IPerror |IP in ICMP

TCP |TCP

TCPAOValue |

TCPerror |TCP in ICMP

UDP |UDP

UDPerror |UDP in ICMP

None

查看报头 Ether：二层，IP：三层,IPv6,IPv4，

print(ls(Ether))

print(ls(IPv6))

print(ls(IP))

version : BitField (4 bits) = ('4')

ihl : BitField (4 bits) = ('None')

tos : XByteField = ('0')

len : ShortField = ('None')

id : ShortField = ('1')

flags : FlagsField = ('<Flag 0 ()>')

frag : BitField (13 bits) = ('0')

ttl : ByteField = ('64')

proto : ByteEnumField = ('0')

chksum : XShortField = ('None')

src : SourceIPField = ('None')

dst : DestIPField = ('None')

options : PacketListField = ('[]')

None

print('-----------------------------------------------')

构造数据包(松散模式，无MAC，遍历网卡)，无提示：

packet_instance = IP(src='192.168.56.1', dst='192.168.56.10') / ICMP()

Send packets at layer 3 and return only the first answer

res = sr1(packet_instance)

多行打印

print('sr1 func:', res.summary())

print('-----------------------------------------------')
print(ls(ICMP))

type +code 就是80，默认为request包

IP / ICMP 192.168.56.10 > 192.168.56.1 echo-reply 0

-----------------------------------------------

type : ByteEnumField = ('8')

code : MultiEnumField (Depends on 8) = ('0')

print('-----------------------------------------------')
pkt = IP(src='192.168.56.1', dst='192.168.56.10') / ICMP()

Send and receive packets at layer 3

包含通的和不通的。

res = sr(pkt)
print('sr func:', res)

(<Results: TCP:0 UDP:0 ICMP:1 Other:0>, <Unanswered: TCP:0 UDP:0 ICMP:0 Other:0>)

查看pkt：

print(pkt.summary)
print(pkt.show())

数据包存储在文件中（写）

wrpcap('icmp1.cap', pkt)
print(rdpcap('icmp1.cap'))

trace查看路由,注意是列表。

a = traceroute(['www.huawei.com'])

print('intfaces:', conf.ifaces)

intfaces: Source Index Name MAC IPv4 IPv6

libpcap 11 Realtek Gaming GbE Family Controller c8:5a:cf:b2:cf:b9 169.254.71.47 fe80::1d46:113a:7d0a:32d4

192.168.31.92

libpcap 16 Bluetooth Device (Personal Area Network) 4c:d5:77:2f:f1:7a 169.254.196.2 fe80::228a:9928:1d88:26cc

libpcap 18 VirtualBox Host-Only Ethernet Adapter 0a:00:27:00:00:12 192.168.56.1 fe80::1417:553d:3311:fb5

def callback(pkt):
print(pkt.summary())

路由过滤：

pkt = sniff(filter='udp',prn=callback, count=9)
wrpcap('icmp2.cap',pkt)

PcapWriter

sniff(filter='udp and src host 192.168.56.10')

print(get_if_list())
print(conf.ifaces)

​