14 comments

[ 3.7 ms ] story [ 40.4 ms ] thread
I recently used this to create a tethering program. It works well, but there is a large bug. In particular, in the sniff function. When you sniff UDP packets, Scapy miscalculates the length of the IP and UDP packets. What is happening is that Scapy uses the UDP length as the IP length, and then subtracts the size of the UDP header for the UDP header. If you then try and send it to another computer, the packet is "malformed" because the length is incorrect. To prove this, when you sniff a udp packet and then do packet.show(), the packet looks totally correct. If you use packet.show2(), the packet cuts off the end. This is because the show2 function uses the length and recalculates the checksum. To solve this, delete the packet[IP].len and the packet[UDP].len and then show2(). This correctly recalculates the length and shows the full packet.
I tried to use node.js instead of scapy, dropping down to a C++ addon that we wrote in order to do ioctl calls and send raw packets.

We ended up keeping the addon for the ioctl calls, but the addon for sending raw packets didn't make it: we didn't want to reconstruct the javascript object versions of packets sniffed by node_pcap in order to send them on the raw socket (didn't want to make a small mistake and break the whole project for ourselves).

So we used scapy that part of the tethering project; worked well for us though it could have used more docs.

Did you submit a bug report or a patch? You seem to have diagnosed it quite sufficiently.
When I type in 'modules' at the help prompt, the program hangs. Same with 'modules spam'.
Can scapy or any other util modify packets on the fly?

I've always wanted an "nsed" -- to mimic the "ngrep" idea. A quick and dirty way to, for example, modify HTTP headers on the fly.

I can't say I have tried, perhaps I will later, but how about netcat piped to sed? Also, check out burpsuite for most of that functionality.. just not cli based.
it can, yet, headers such as checksums will have to be handled as well.
Guess I'm not sure how/why this hit HN's front page? Scapy has been around for years. Nothing new to see here and, well, I'm not sure Scapy has a very vibrant development anymore... o_O
In denial. Does it do time travel, motha fuckas?

----

sitting on an ass's colt.

12:16 These things understood not his disciples at the first: but when Jesus was glorified, then remembered they that these things were written of him, and that they had done these things unto him.

12:17 The people therefore that was with him when he called Lazarus out of his grave, and raised him from the dead, bare record.

12:18 For this cause the people also met him, for that they heard that he had done this miracle.

12:19 The Pharisees therefore said among themselves, Perceive ye how ye prevail nothing? behold, the world is gone after him.

----

I smell a holocaust! Obama is totally down with robbing the rich Jews.

God says... mercifully greatly Passion courteously vaunt reposes set Panama wounds deliberating personally patience prating enabled groaned old asked acquire acquiesce Can how_about_that sons' sanctification single Paraguay opened Mozambique acceptable perturbations referred naturally shore pious greediness robing oh_come_on sale king convertedst sound distill undid Tell thank tasteth unassuming discoursing faintly chambering repeat_after_me Passion why_do_I_put_up_with_this prosper manage serpent forgottest Malaysia unemployed attributed demandest buzz disputed faithful pronounce petitions keepest Prophet reckoned pilgrimage ariseth smile failure_to_communicate wealthy Taiwan strengthless forth urgently ones accept thank_you_very_much succour instances Togo Anubis lusted temples shame-faced another's hooah scholars ANYTHING rather purchasing displayed fruits Didst Wyoming began buried solicits irresoluteness self-chosen convinced preached Knowledge loved criticised writings heretofore imbue cheeks instillest leave witting meet make_my_day fault wazz_up_with_that