472,952 Members | 2,661 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 472,952 software developers and data experts.

Impacket and packet sniffing

16
Hi All

I have found the simple script that sniffs ICMP packets using Impacket and pcapy. At the moment it is capturing the packet header and data, I was just wondering if anyone knows a way to get it to capture the packet headers only?
Expand|Select|Wrap|Line Numbers
  1. #!/usr/bin/python
  2. ### sniffer
  3. import pcapy
  4. from impacket.ImpactDecoder import *
  5.  
  6. def recv_pkts(hdr, data):
  7.     x = EthDecoder().decode(data)
  8.     print x
  9.  
  10. def get_int():
  11.     devs = pcapy.findalldevs()
  12.     i=0
  13.     for eth in devs:
  14.         print " %d - %s" %(i,devs[i])
  15.         i+=1
  16.     sel=input(" Select interface: ")
  17.     dev=devs[sel]
  18.     return dev
  19.  
  20. dev = get_int()
  21. p = pcapy.open_live(dev, 1500, 0, 100)
  22. p.setfilter('icmp')
  23. print "Listening on eth: net=%s, mask=%s\n" % (p.getnet(), p.getmask())
  24. p.loop(-1, recv_pkts) 
Thanks
Aug 1 '07 #1
3 8401
bartonc
6,596 Expert 4TB
Hi All

I have found the simple script that sniffs ICMP packets using Impacket and pcapy. At the moment it is capturing the packet header and data, I was just wondering if anyone knows a way to get it to capture the packet headers only?
Expand|Select|Wrap|Line Numbers
  1. #!/usr/bin/python
  2. ### sniffer
  3. import pcapy
  4. from impacket.ImpactDecoder import *
  5.  
  6. def recv_pkts(hdr, data):
  7.     x = EthDecoder().decode(data)
  8.     print x
  9.  
  10. def get_int():
  11.     devs = pcapy.findalldevs()
  12.     i=0
  13.     for eth in devs:
  14.         print " %d - %s" %(i,devs[i])
  15.         i+=1
  16.     sel=input(" Select interface: ")
  17.     dev=devs[sel]
  18.     return dev
  19.  
  20. dev = get_int()
  21. p = pcapy.open_live(dev, 1500, 0, 100)
  22. p.setfilter('icmp')
  23. print "Listening on eth: net=%s, mask=%s\n" % (p.getnet(), p.getmask())
  24. p.loop(-1, recv_pkts) 
Thanks
I think I see what's going on here:
On line 24, the loop() function gets the recv_pkts() function (defined on line 6) as its second argument. That makes the (hdr, data) arguments required. All you have to do is not use the data in YOUR recv_pkts() function:
Expand|Select|Wrap|Line Numbers
  1. def recv_pkts(hdr, data):
  2.     ##  x = EthDecoder().decode(data)
  3.     print hdr
Aug 1 '07 #2
T00l
16
Hi, Thanks for the reply, I have done as suggested and it does now appear to only be reading the headers, however they are in the format as shown below and not printing the actual header data, any ideas why?

C:\scripts>python tcp.py
0 - \Device\NPF_GenericDialupAdapter
1 - \Device\NPF_{60B0D7E9-10AC-46F6-8528-A40D066DFF72}
2 - \Device\NPF_{62E01695-B732-41F6-9F22-A9B92D20E3F2}
3 - \Device\NPF_{0650A74D-212C-4E76-89A1-E4D4F18EA3DE}
Select interface: 2
Listening on eth: net=80.42.47.246, mask=255.255.255.255

<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>

Many Thanks
Aug 2 '07 #3
T00l
16
Hi, Thanks for the reply, I have done as suggested and it does now appear to only be reading the headers, however they are in the format as shown below and not printing the actual header data, any ideas why?

C:\scripts>python tcp.py
0 - \Device\NPF_GenericDialupAdapter
1 - \Device\NPF_{60B0D7E9-10AC-46F6-8528-A40D066DFF72}
2 - \Device\NPF_{62E01695-B732-41F6-9F22-A9B92D20E3F2}
3 - \Device\NPF_{0650A74D-212C-4E76-89A1-E4D4F18EA3DE}
Select interface: 2
Listening on eth: net=80.42.47.246, mask=255.255.255.255

<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>

Many Thanks

I've been playing around with this a bit more and it looks like it isn't just icking up the headers but is displaying an error for each packet receieved. I've tried to modify the code as below

def recv_pkts(hdr, data):
x = IPDecoder(hdr)
print x

But getting the following error

Traceback (most recent call last):
File "tcp.py", line 25, in <module>
p.loop(-1, recv_pkts)
File "tcp.py", line 8, in recv_pkts
x = IPDecoder(hdr)
TypeError: __init__() takes exactly 1 argument (2 given)

Anyone got any ideas?

Thanks
Aug 5 '07 #4

Sign in to post your reply or Sign up for a free account.

Similar topics

0
by: ias0nas | last post by:
Hello, I have been using Impacket to produce some packets, but unfortunatelly it does not provide functionality for changing the sequence number of a packet and leaves it to 0. Is it possible...
2
by: billiejoex | last post by:
Hi all. I'm using pcapy module to sniff some ICMP packets. I would like to modify this source: http://www.google.it/search?hl=it&q=pcapy&btnG=Cerca+con+Google&meta= and visualize only the DATA...
2
by: Anony | last post by:
Hi All, I used raw socket to sniff packet data. Now it can sniff only incoming packet, not outgoing data anymore. I don't know if it's due to the installation of XP SP2, firewall or other...
0
by: Nuno Magalhaes | last post by:
Why does C# only supports LAN packet sniffing? Should I have to use WinPCap if I want to capture the outgoing packets on xp pro also? Why this limitation? Here's the source for capturing the...
4
by: Dusan Micuch | last post by:
Hi, What's best way for Watching my Packet TCP and UDP ? Socket ? Some external DLL ? What I need to use for build programs like this? I want measure data on specific or anyone port at Real Time....
1
by: anton07 | last post by:
im a final year undergrad student..and i want to develop a packet sniffing software..but ive got no idea about what software's to use..hope i can get some help here..thanks so much.. or if there's...
3
by: nexus024 | last post by:
I am trying to write a program that will continuously sniff eth0 for a specific UDP packet thats being sent to a specific destination IP, alter the data of the packet, and finally transmit it to the...
1
by: sangith | last post by:
Hi, I tried the packet capture module program. I did a file transfer using ftp from this host to another server. But when I ran the program, it was just hanging off and it did not print the...
1
by: Ken Fine | last post by:
I have been investigating programmatically downloading FLV content from various sites ("video scraping"??) Many interactive GUI tools do this, such as the Orbit downloader. At the heart of them...
0
by: lllomh | last post by:
Define the method first this.state = { buttonBackgroundColor: 'green', isBlinking: false, // A new status is added to identify whether the button is blinking or not } autoStart=()=>{
2
by: DJRhino | last post by:
Was curious if anyone else was having this same issue or not.... I was just Up/Down graded to windows 11 and now my access combo boxes are not acting right. With win 10 I could start typing...
2
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 4 Oct 2023 starting at 18:00 UK time (6PM UTC+1) and finishing at about 19:15 (7.15PM) The start time is equivalent to 19:00 (7PM) in Central...
0
tracyyun
by: tracyyun | last post by:
Hello everyone, I have a question and would like some advice on network connectivity. I have one computer connected to my router via WiFi, but I have two other computers that I want to be able to...
2
by: giovanniandrean | last post by:
The energy model is structured as follows and uses excel sheets to give input data: 1-Utility.py contains all the functions needed to calculate the variables and other minor things (mentions...
4
NeoPa
by: NeoPa | last post by:
Hello everyone. I find myself stuck trying to find the VBA way to get Access to create a PDF of the currently-selected (and open) object (Form or Report). I know it can be done by selecting :...
1
by: Teri B | last post by:
Hi, I have created a sub-form Roles. In my course form the user selects the roles assigned to the course. 0ne-to-many. One course many roles. Then I created a report based on the Course form and...
3
by: nia12 | last post by:
Hi there, I am very new to Access so apologies if any of this is obvious/not clear. I am creating a data collection tool for health care employees to complete. It consists of a number of...
0
NeoPa
by: NeoPa | last post by:
Introduction For this article I'll be focusing on the Report (clsReport) class. This simply handles making the calling Form invisible until all of the Reports opened by it have been closed, when it...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.