Date created: 04/06/18 11:30:44. Last modified: 09/07/18 09:36:43

Scapy Examples

Scapy Notes:

List protocols with ls() and funcstions with lsc()
Check a specific protocol with Ether().show()
List custom modules with: list_contrib()
To load a custom module like MPLS use: load_contrib("mpls")
Check with: MPLS().show()

Gratuitous ARP Example:

arp_eth = Ether(src='5e:f1:74:c1:58:bd', dst='ca:01:07:fc:00:08', type="ARP")
arp_arp = ARP(psrc='10.0.255.2', hwsrc='5e:f1:74:c1:58:bd', hwdst='ca:01:07:fc:00:08', pdst='10.0.255.1', op='is-at')
arp_frame=arp_eth/arp_arp
Ether(str(arp_frame))

sendp(arp_frame, iface="eth1")

 

HSRP Example:

ip = IP(src='10.0.0.2', dst='224.0.0.2')
udp = UDP()
hsrp = HSRP(group=1, priority=255, virtualIP='10.0.0.2')
frm=Ether()/ip/udp/hsrp
b=str(frm)
c=Ether(b)

>>> c
<Ether dst=01:00:5e:00:00:02 src=9c:4e:36:c9:b4:98 type=IPv4 |<IP version=4L ihl=5L tos=0x0 len=48 id=1 flags= frag=0L ttl=64 proto=udp chksum=0x90b8 src=10.0.0.2 dst=224.0.0.2 options=[] |<UDP sport=1985 dport=1985 len=28 chksum=0x9a5f |<HSRP version=0 opcode=Hello state=Active hellotime=3 holdtime=10 priority=255 group=1 reserved=0 auth='cisco' virtualIP=10.0.0.1 |>>>> >>> hexdump(c) 0000 01 00 5E 00 00 02 9C 4E 36 C9 B4 98 08 00 45 00 ..^....N6.....E. 0010 00 30 00 01 00 00 40 11 90 B8 0A 00 00 02 E0 00 [email protected] 0020 00 02 07 C1 07 C1 00 1C 9A 5F 00 00 10 03 0A FF ........._...... 0030 01 00 63 69 73 63 6F 00 00 00 0A 00 00 01 ..cisco.......

 

MPLS Example:

load_contrib("mpls")
mpls_eth = Ether(src="11:11:11:11:11:11", dst="ca:01:07:fc:00:1c", type=0x8847)
mpls_lables=MPLS(label=16, s=0, ttl=255)/MPLS(label=18, s=0, ttl=255)/MPLS(label=18, s=0, ttl=255)/MPLS(label=16, s=1, ttl=255)
mpls_ip = IP(src='10.0.255.2', dst='10.0.255.2')
mpls_icmp = ICMP(type="echo-request")
mpls_raw = Raw(load="Foooooooooooooooook!")
mpls_frame=mpls_eth/mpls_lables/mpls_ip/mpls_icmp/mpls_raw

>>> Ether(str(mpls_frame))
<Ether dst=ca:01:07:fc:00:1c src=11:11:11:11:11:11 type=0x8847 |<MPLS label=16 cos=0 s=0 ttl=255 |<MPLS label=18 cos=0 s=0 ttl=255 |<MPLS label=18 cos=0 s=0 ttl=255 |<MPLS label=16 cos=0 s=1 ttl=255 |<IP version=4 ihl=5 tos=0x0 len=48 id=1 flags= frag=0 ttl=64 proto=icmp chksum=0x68c7 src=10.0.255.2 dst=10.0.255.2 options=[] |<ICMP type=echo-request code=0 chksum=0xcaf3 id=0x0 seq=0x0 |<Raw load='Foooooooooooooooook!' |>>>>>>>>
sendp(mpls_frame, iface="eth1") sendp(mpls_frame, iface="eth1", loop=1, inter=0.1)

 

Ping Example:

ping_eth = Ether(src='5e:f1:74:c1:58:bd', dst='ca:01:07:fc:00:08', type="IPv4")
ping_ip = IP(src='10.0.255.2', dst='10.0.255.1')
ping_icmp = ICMP(type="echo-request")
ping_raw = Raw(load="123456789012345678901234567890")
ping_frame=ping_eth/ping_ip/ping_icmp/ping_raw
Ether(str(ping_frame))

sendp(ping_frame, iface="eth1")