Impacket and packet sniffing

[T00l]

Hi All

I have found the simple script that sniffs ICMP packets using Impacket and pcapy. At the moment it is capturing the packet header and data, I was just wondering if anyone knows a way to get it to capture the packet headers only?

#!/usr/bin/python
### sniffer
import pcapy
from impacket.ImpactDecoder import *
 
def recv_pkts(hdr, data):
    x = EthDecoder().decode(data)
    print x
 
def get_int():
    devs = pcapy.findalldevs()
    i=0
    for eth in devs:
        print " %d - %s" %(i,devs[i])
        i+=1
    sel=input(" Select interface: ")
    dev=devs[sel]
    return dev
 
dev = get_int()
p = pcapy.open_live(dev, 1500, 0, 100)
p.setfilter('icmp')
print "Listening on eth: net=%s, mask=%s\n" % (p.getnet(), p.getmask())
p.loop(-1, recv_pkts) 

Thanks

[bartonc]

Hi All

I have found the simple script that sniffs ICMP packets using Impacket and pcapy. At the moment it is capturing the packet header and data, I was just wondering if anyone knows a way to get it to capture the packet headers only?

#!/usr/bin/python
### sniffer
import pcapy
from impacket.ImpactDecoder import *
 
def recv_pkts(hdr, data):
    x = EthDecoder().decode(data)
    print x
 
def get_int():
    devs = pcapy.findalldevs()
    i=0
    for eth in devs:
        print " %d - %s" %(i,devs[i])
        i+=1
    sel=input(" Select interface: ")
    dev=devs[sel]
    return dev
 
dev = get_int()
p = pcapy.open_live(dev, 1500, 0, 100)
p.setfilter('icmp')
print "Listening on eth: net=%s, mask=%s\n" % (p.getnet(), p.getmask())
p.loop(-1, recv_pkts) 

Thanks

I think I see what's going on here:
On line 24, the loop() function gets the recv_pkts() function (defined on line 6) as its second argument. That makes the (hdr, data) arguments required. All you have to do is not use the data in YOUR recv_pkts() function:

def recv_pkts(hdr, data):
    ##  x = EthDecoder().decode(data)
    print hdr

[T00l]

Hi, Thanks for the reply, I have done as suggested and it does now appear to only be reading the headers, however they are in the format as shown below and not printing the actual header data, any ideas why?

C:\scripts>python tcp.py
0 - \Device\NPF_GenericDialupAdapter
1 - \Device\NPF_{60B0D7E9-10AC-46F6-8528-A40D066DFF72}
2 - \Device\NPF_{62E01695-B732-41F6-9F22-A9B92D20E3F2}
3 - \Device\NPF_{0650A74D-212C-4E76-89A1-E4D4F18EA3DE}
Select interface: 2
Listening on eth: net=80.42.47.246, mask=255.255.255.255

<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>

Many Thanks

[T00l]

Hi, Thanks for the reply, I have done as suggested and it does now appear to only be reading the headers, however they are in the format as shown below and not printing the actual header data, any ideas why?

C:\scripts>python tcp.py
0 - \Device\NPF_GenericDialupAdapter
1 - \Device\NPF_{60B0D7E9-10AC-46F6-8528-A40D066DFF72}
2 - \Device\NPF_{62E01695-B732-41F6-9F22-A9B92D20E3F2}
3 - \Device\NPF_{0650A74D-212C-4E76-89A1-E4D4F18EA3DE}
Select interface: 2
Listening on eth: net=80.42.47.246, mask=255.255.255.255

<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>
<Pkthdr object at 0x00B1A530>

Many Thanks

I've been playing around with this a bit more and it looks like it isn't just icking up the headers but is displaying an error for each packet receieved. I've tried to modify the code as below

def recv_pkts(hdr, data):
x = IPDecoder(hdr)
print x

But getting the following error

Traceback (most recent call last):
File "tcp.py", line 25, in <module>
p.loop(-1, recv_pkts)
File "tcp.py", line 8, in recv_pkts
x = IPDecoder(hdr)
TypeError: __init__() takes exactly 1 argument (2 given)

Anyone got any ideas?

Thanks