Scapy http sniffer how to#
Scapy http sniffer code#

So how’s the performance this time around? It turned out to be surprisingly fast. Ip_sniff = IPSniff('eth3', test_incoming_callback, test_outgoing_callback) Print('outgoing - src=%s, dst=%s, frame len = %d' %(socket.inet_ntoa(src), socket.inet_ntoa(dst), len(frame)))ĭef test_outgoing_callback(src, dst, frame): Print('incoming - src=%s, dst=%s, frame len = %d' Self._process_ipframe(sa_ll, ip_header, payload)ĭef test_incoming_callback(src, dst, frame): If type = socket.PACKET_OUTGOING and self.on_ip_outgoing is None:Įth_header = struct.unpack('!6s6sH', pkt)ĭummy_eth_protocol = socket.ntohs(eth_header) Self.on_ip_incoming(ip_src, ip_dst, ip_frame) Self.on_ip_outgoing(ip_src, ip_dst, ip_frame) # Extract the 20 bytes IP header, ignoring the IP optionsįields = struct.unpack('!BBHHHBBHII', ip_header) ((self.interface_name, ETH_P_ALL))ĭef _process_ipframe(self, pkt_type, ip_header, payload): (socket.SOL_SOCKET, socket.SO_RCVBUF, 2**30) Socket.AF_PACKET, socket.SOCK_RAW, socket.htons(ETH_P_ALL)) # for all packets going through a specific interface. # The raw in (listen) socket is a L2 raw socket that listens 元 socket does not appear to provide this capabilities.ĭef _init_(self, interface_name, on_ip_incoming, on_ip_outgoing): *Layer 2 socket is chosen because I need to sniff both incoming and outgoing packets on a network interface. So if a layer 2 socket is implemented, the host application will receive all ethernet frames. In user space, if an application creates a raw socket, the linux kernel will automatically forward a copy of the datagram of the same protocol number to the application. Since Scapy comes with too much overhead, the next step was to dive into a lower layer and implement a raw layer 2 socket. HTTP responses have different sections separated by , by convention.Calling split(' ') on the string produced by sprintf creates a list of strings, with one element for each part, and then ' '.join creates a string by joining the elements of this list with a ' ' (newline character) between them. This is an unacceptable amount of overhead for just routing packets from kernel into user space. It turns out that a ~4.4MBps (35Mbps) capture would consume close to 100% of my CPU. Unfortunately, Scapy didn’t perform so well.Ĥ.4 MBps data rate results in 100% usage. The file is large, and the data rate is reasonably high for a quick test. So how about some stress test? For that, I browsed to the Ubuntu homepage and downloaded an Ubuntu ISO.

Scapy http sniffer code#

On the first try, the above code functioned perfectly and I immediately saw all the incoming and outgoing packets as I browsed through different webpages to trigger http traffic. My co-worker’s Google-Fu quickly found that the Scapy package has a sniff feature, and yes, it is a one-liner. And this time, Python did not disappoint me. My past experience with Python is that it often comes with magical one-liner that just finish my job. So I chose Python for some rapid prototyping to get a feel for the problem.

The project does not have high data rate requirement. In other word, I need to write a IP packets sniffer similar to tcpdump or wireshark. Ret += ' '.join(packet1.sprintf(' ').Recently my latest project came with a strange requirement – I need to route IP packets from Linux kernel space to user space. Here's a code which I'm trying to understand #!/usr/bin/python

Scapy http sniffer how to#

I was trying to understand how to make a http sniffer in python scapy