I have a simple python script, that creates a socket AF_PACKET
, which parses all IPv4 packets and retrieves the source and destination IP addresses:
import socket
import struct
def get_ip(s):
return '.'.join([str(ord(symbol)) for symbol in s])
def main():
conn = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.ntohs(3))
while True:
pkt, addr = conn.recvfrom(65536)
proto = struct.unpack('! H', pkt[12:14])
eth_proto = socket.htons(proto[0])
print('eth_proto = ', eth_proto)
if eth_proto == 8:
src, target = struct.unpack('! 4s 4s', pkt[26:34])
source_ip = get_ip(src)
destination_ip = get_ip(target)
print('Source IP = ', source_ip)
print('Destination IP = ', destination_ip)
main()
Is it possible to refactor getting the IP address, so it will look better and doesn't use this loop:
'.'.join([str(ord(symbol)) for symbol in s])
Format characters is described here: https://docs.python.org/2/library/struct.html
If you are using Python 2 (as you have linked to the Python 2 docs), you can use a bytearray and a format string to remove the explicit loop.
>>> s = '\n\x0b\xfa\x01'
>>> '{}.{}.{}.{}'.format(*bytearray(s))
'10.11.250.1'
If you are using Python 3.3+, you can use the standard library's ipaddress module.
>> ipa2 = ipaddress.ip_address(b'\n\x0b\xfa\x01')
>>> ipa2
IPv4Address('10.11.250.1')
>>> str(ipa2)
'10.11.250.1'
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.