[英]Python arp sniffing raw socket no reply packets
為了更好地理解網絡概念並提高我的python技能,我試圖用python實現數據包嗅探器。 我剛開始學習python,所以代碼當然可以優化;)
我已經實現了一個數據包嗅探器,它解壓縮了以太網幀和arp頭。 我想用原始套接字制作它,因為我想了解這些標題中的每個字節,所以請不要scapy幫助:)
問題是,我不會得到任何arp回復數據包。 它始終是操作碼1和我
這是我的源代碼:
import socket
import struct
import binascii
rawSocket = socket.socket(socket.PF_PACKET, socket.SOCK_RAW, socket.htons(0x0806))
while True:
packet = rawSocket.recvfrom(2048)
ethernet_header = packet[0][0:14]
ethernet_detailed = struct.unpack("!6s6s2s", ethernet_header)
arp_header = packet[0][14:42]
arp_detailed = struct.unpack("2s2s1s1s2s6s4s6s4s", arp_header)
print "****************_ETHERNET_FRAME_****************"
print "Dest MAC: ", binascii.hexlify(ethernet_detailed[0])
print "Source MAC: ", binascii.hexlify(ethernet_detailed[1])
print "Type: ", binascii.hexlify(ethernet_detailed[2])
print "************************************************"
print "******************_ARP_HEADER_******************"
print "Hardware type: ", binascii.hexlify(arp_detailed[0])
print "Protocol type: ", binascii.hexlify(arp_detailed[1])
print "Hardware size: ", binascii.hexlify(arp_detailed[2])
print "Protocol size: ", binascii.hexlify(arp_detailed[3])
print "Opcode: ", binascii.hexlify(arp_detailed[4])
print "Source MAC: ", binascii.hexlify(arp_detailed[5])
print "Source IP: ", socket.inet_ntoa(arp_detailed[6])
print "Dest MAC: ", binascii.hexlify(arp_detailed[7])
print "Dest IP: ", socket.inet_ntoa(arp_detailed[8])
print "*************************************************\n"
有人可以解釋一下我為什么沒有得到這些響應包嗎?
OUTPUT:
****************_ETHERNET_FRAME_****************
Dest MAC: ffffffffffff
Source MAC: 0012bfc87243
Type: 0806
************************************************
******************_ARP_HEADER_******************
Hardware type: 0001
Protocol type: 0800
Hardware size: 06
Protocol size: 04
Opcode: 0001
Source MAC: 0012bfc87243
Source IP: 192.168.2.1
Dest MAC: 000000000000
Dest IP: 192.168.2.226
*************************************************
謝謝到目前為止! :)
我認為您需要指定套接字協議號0x0003
來嗅探所有內容,然后在事后過濾掉非ARP數據包。 這對我有用:
import socket
import struct
import binascii
rawSocket = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.htons(0x0003))
while True:
packet = rawSocket.recvfrom(2048)
ethernet_header = packet[0][0:14]
ethernet_detailed = struct.unpack("!6s6s2s", ethernet_header)
arp_header = packet[0][14:42]
arp_detailed = struct.unpack("2s2s1s1s2s6s4s6s4s", arp_header)
# skip non-ARP packets
ethertype = ethernet_detailed[2]
if ethertype != '\x08\x06':
continue
print "****************_ETHERNET_FRAME_****************"
print "Dest MAC: ", binascii.hexlify(ethernet_detailed[0])
print "Source MAC: ", binascii.hexlify(ethernet_detailed[1])
print "Type: ", binascii.hexlify(ethertype)
print "************************************************"
print "******************_ARP_HEADER_******************"
print "Hardware type: ", binascii.hexlify(arp_detailed[0])
print "Protocol type: ", binascii.hexlify(arp_detailed[1])
print "Hardware size: ", binascii.hexlify(arp_detailed[2])
print "Protocol size: ", binascii.hexlify(arp_detailed[3])
print "Opcode: ", binascii.hexlify(arp_detailed[4])
print "Source MAC: ", binascii.hexlify(arp_detailed[5])
print "Source IP: ", socket.inet_ntoa(arp_detailed[6])
print "Dest MAC: ", binascii.hexlify(arp_detailed[7])
print "Dest IP: ", socket.inet_ntoa(arp_detailed[8])
print "*************************************************\n"
示例輸出使用arpping
從相同的主機和答復廣播:
****************_ETHERNET_FRAME_****************
Dest MAC: ffffffffffff
Source MAC: 000c29eb37bf
Type: 0806
************************************************
******************_ARP_HEADER_******************
Hardware type: 0001
Protocol type: 0800
Hardware size: 06
Protocol size: 04
Opcode: 0001
Source MAC: 000c29eb37bf
Source IP: 192.168.16.133
Dest MAC: ffffffffffff
Dest IP: 192.168.16.2
*************************************************
****************_ETHERNET_FRAME_****************
Dest MAC: 000c29eb37bf
Source MAC: 005056f37861
Type: 0806
************************************************
******************_ARP_HEADER_******************
Hardware type: 0001
Protocol type: 0800
Hardware size: 06
Protocol size: 04
Opcode: 0002
Source MAC: 005056f37861
Source IP: 192.168.16.2
Dest MAC: 000c29eb37bf
Dest IP: 192.168.16.133
*************************************************
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.