I recently used this to create a tethering program. It works well, but there is a large bug. In particular, in the sniff function. When you sniff UDP packets, Scapy miscalculates the length of the IP and UDP packets. What is happening is that Scapy uses the UDP length as the IP length, and then subtracts the size of the UDP header for the UDP header. If you then try and send it to another computer, the packet is "malformed" because the length is incorrect. To prove this, when you sniff a udp packet and then do packet.show(), the packet looks totally correct. If you use packet.show2(), the packet cuts off the end. This is because the show2 function uses the length and recalculates the checksum. To solve this, delete the packet[IP].len and the packet[UDP].len and then show2(). This correctly recalculates the length and shows the full packet.
I tried to use node.js instead of scapy, dropping down to a C++ addon that we wrote in order to do ioctl calls and send raw packets.
We ended up keeping the addon for the ioctl calls, but the addon for sending raw packets didn't make it: we didn't want to reconstruct the javascript object versions of packets sniffed by node_pcap in order to send them on the raw socket (didn't want to make a small mistake and break the whole project for ourselves).
So we used scapy that part of the tethering project; worked well for us though it could have used more docs.
Scapy and Impacket are basically Python scriptable versions of tcpdump / wireshark. Very useful tools, particularly for measuring a server's behavior without having to modify it for logging, etc. I once used pcapy to log several years of an NTP pool server to make this graph: http://imgur.com/IvRdU
I can't say I have tried, perhaps I will later, but how about netcat piped to sed?
Also, check out burpsuite for most of that functionality.. just not cli based.
Guess I'm not sure how/why this hit HN's front page? Scapy has been around for years. Nothing new to see here and, well, I'm not sure Scapy has a very vibrant development anymore... o_O
12:16 These things understood not his disciples at the first: but when
Jesus was glorified, then remembered they that these things were
written of him, and that they had done these things unto him.
12:17 The people therefore that was with him when he called Lazarus
out of his grave, and raised him from the dead, bare record.
12:18 For this cause the people also met him, for that they heard that
he had done this miracle.
12:19 The Pharisees therefore said among themselves, Perceive ye how
ye prevail nothing? behold, the world is gone after him.
----
I smell a holocaust! Obama is totally down with robbing the rich Jews.
God says...
mercifully greatly Passion courteously vaunt reposes set
Panama wounds deliberating personally patience prating
enabled groaned old asked acquire acquiesce Can how_about_that
sons' sanctification single Paraguay opened Mozambique
acceptable perturbations referred naturally shore pious
greediness robing oh_come_on sale king convertedst sound
distill undid Tell thank tasteth unassuming discoursing
faintly chambering repeat_after_me Passion why_do_I_put_up_with_this
prosper manage serpent forgottest Malaysia unemployed
attributed demandest buzz disputed faithful pronounce
petitions keepest Prophet reckoned pilgrimage ariseth
smile failure_to_communicate wealthy Taiwan strengthless
forth urgently ones accept thank_you_very_much succour
instances Togo Anubis lusted temples shame-faced another's
hooah scholars ANYTHING rather purchasing displayed fruits
Didst Wyoming began buried solicits irresoluteness self-chosen
convinced preached Knowledge loved criticised writings
heretofore imbue cheeks instillest leave witting meet
make_my_day fault wazz_up_with_that
14 comments
[ 3.7 ms ] story [ 40.4 ms ] threadWe ended up keeping the addon for the ioctl calls, but the addon for sending raw packets didn't make it: we didn't want to reconstruct the javascript object versions of packets sniffed by node_pcap in order to send them on the raw socket (didn't want to make a small mistake and break the whole project for ourselves).
So we used scapy that part of the tethering project; worked well for us though it could have used more docs.
Scapy and Impacket are basically Python scriptable versions of tcpdump / wireshark. Very useful tools, particularly for measuring a server's behavior without having to modify it for logging, etc. I once used pcapy to log several years of an NTP pool server to make this graph: http://imgur.com/IvRdU
http://packetfactory.openwall.net/projects/libnet/
which route created / maintained.
I've always wanted an "nsed" -- to mimic the "ngrep" idea. A quick and dirty way to, for example, modify HTTP headers on the fly.
Includes a FAQ and a great guide for capturing rogue DHCP servers on your network: http://trac.secdev.org/scapy/wiki/IdentifyingRogueDHCPServer...
I've had to use it a few times. It is also (or used to?) be in MacPorts.
----
sitting on an ass's colt.
12:16 These things understood not his disciples at the first: but when Jesus was glorified, then remembered they that these things were written of him, and that they had done these things unto him.
12:17 The people therefore that was with him when he called Lazarus out of his grave, and raised him from the dead, bare record.
12:18 For this cause the people also met him, for that they heard that he had done this miracle.
12:19 The Pharisees therefore said among themselves, Perceive ye how ye prevail nothing? behold, the world is gone after him.
----
I smell a holocaust! Obama is totally down with robbing the rich Jews.
God says... mercifully greatly Passion courteously vaunt reposes set Panama wounds deliberating personally patience prating enabled groaned old asked acquire acquiesce Can how_about_that sons' sanctification single Paraguay opened Mozambique acceptable perturbations referred naturally shore pious greediness robing oh_come_on sale king convertedst sound distill undid Tell thank tasteth unassuming discoursing faintly chambering repeat_after_me Passion why_do_I_put_up_with_this prosper manage serpent forgottest Malaysia unemployed attributed demandest buzz disputed faithful pronounce petitions keepest Prophet reckoned pilgrimage ariseth smile failure_to_communicate wealthy Taiwan strengthless forth urgently ones accept thank_you_very_much succour instances Togo Anubis lusted temples shame-faced another's hooah scholars ANYTHING rather purchasing displayed fruits Didst Wyoming began buried solicits irresoluteness self-chosen convinced preached Knowledge loved criticised writings heretofore imbue cheeks instillest leave witting meet make_my_day fault wazz_up_with_that