Python基础知识：使用Scapy制作数据包

总览 (Overview)

This article introduces Scapy at a high level and shows an example of crafting an ICMP echo request by using the CLI tool and by importing Scapy modules into a Python script. The article assumes a basic understanding of TCP/IP networking concepts is held.

本文从高层次介绍了Scapy，并显示了一个使用CLI工具并将Scapy模块导入Python脚本中来构造ICMP回显请求的示例。 本文假定对TCP / IP网络概念具有基本的了解。

Python Version Used:3.6.6

使用的Python版本： 3.6.6

Commented Code Available on GitHub:https://github.com/bmaya1/python-basic-examples/blob/master/scapy/simple-scapy-icmp-request.py

注释代码可在GitHub上找到： https : //github.com/bmaya1/python-basic-examples/blob/master/scapy/simple-scapy-icmp-request.py

Scapy Documentation:

Scapy文档：

• https://scapy.readthedocs.io/en/latest/introduction.html

  https://scapy.readthedocs.io/en/latest/introduction.html

Scapy是什么？ (What is Scapy?)

Scapy is a tool written by Philippe Biondi and per the documentation is described as: “a Python program that enables the user to send, sniff and dissect and forge network packets. This capability allows construction of tools that can probe, scan or attack networks.”

Scapy是Philippe Biondi编写的工具，根据文档描述为： “一个Python程序，使用户能够发送，嗅探，剖析和伪造网络数据包。 这种功能允许构建可以探测，扫描或攻击网络的工具。”

Essentially, Scapy is a tool that allows packet manipulation and can be used for multiple purposes such as:

本质上，Scapy是允许数据包处理的工具，可用于多种目的，例如：

• Reading/writing pcap files

  读取/写入pcap文件

• Testing Snort rules

  测试Snort规则

• Automating logic by importing Scapy modules into a Python script

  通过将Scapy模块导入Python脚本来实现逻辑自动化

使用范例 (Usage Examples)

Scapy can be used through the command line interface (Method 1), but can also be imported into a Python script (Method 2). The examples below will demonstrate how to craft an ICMP echo request using both methods.

Scapy可以通过命令行界面使用(方法1)，但也可以导入到Python脚本中(方法2)。 下面的示例将演示如何使用这两种方法来制作ICMP回显请求。

1.通过CLI使用Scapy (1. Using Scapy via CLI)

An important note from the documentation is that: “Root privileges are needed to send the packets”.

该文档中的重要说明是：“ 发送数据包需要root特权”。

As such, sudo must be used to launch Scapy:

因此，必须使用sudo来启动Scapy：

sudo scapy

At a minimum, two layers are needed for this example. The first is the IP layer where the destination IP will be listed:

此示例至少需要两层。 第一个是将列出目标IP的IP层 ：

>> ip_layer = IP(dst="172.16.27.135")

Next, the defined ICMP layer will specify a sequence number of 9999:

接下来，定义的ICMP层将指定序列号9999 ：

>>> icmp_layer = ICMP(seq=9999)

To combine both layers, the / character can be used:

要组合两层，可以使用/字符：

>>> packet = ip_layer / icmp_layer

Finally, the packet is sent:

最后，发送数据包：

>>> send(packet)

2.在Python脚本中使用Scapy (2. Using Scapy in a Python Script)

For this example, a new file example.py is created with the following two lines:

对于此示例，使用以下两行创建一个新文件example.py ：

#! /usr/bin/env pythonfrom scapy.all import *

The first line specifies the use of the Python interpreter. The second line is used to import all Scapy packages.

第一行指定了Python解释器的用法。 第二行用于导入所有 Scapy软件包。

Next, the four lines of code (discussed in the previous section) are pasted into the file:

接下来，将四行代码(在上一节中讨论过)粘贴到文件中：

ip_layer = IP(dst="172.16.27.135")
icmp_layer = ICMP(seq=9999)
packet = ip_layer / icmp_layer
send(packet)

Finally, it is time to run the Python script using sudo:

最后，是时候使用sudo运行Python脚本了：

sudo python example.py

验证ICMP回声请求 (Verify ICMP Echo Request)

Wireshark can help verify that the sequence number9999 is actually set in the ICMP echo request. Prior to running example.py, Wireshark was started and it captured the following.

Wireshark可以帮助验证ICMP回显请求中是否实际设置了序列号9999 。 在运行example.py之前，Wireshark已启动，并且捕获了以下内容。

Image 1 — Wireshark Displaying ICMP Echo Request 图1 — Wireshark显示ICMP回显请求

The sequence number can be seen in the Info section in Image 1.

序列号可以在图像1的“ 信息”部分中看到。

The sequence number can also be verified by expanding the Internet Control Message Protocol section as seen in Image 2.

也可以通过扩展Internet控制消息协议部分来验证序列号，如图2所示。

Image 2 — Sequence Number 9999 Set 图像2 —序列号9999集

有很多值得探索的地方！ (There Is Much To Explore!)

There are several ways Scapy may be used, and this article only introduced its capabilities with a simple example. Scapy is a powerful tool and can help understand packets/traffic in a detailed manner.

可以使用Scapy几种方式，本文仅以一个简单的示例介绍了其功能。 Scapy是一个功能强大的工具，可以帮助您详细了解数据包/流量。

翻译自: https://medium.com/python-in-plain-english/python-basics-packet-crafting-with-scapy-b3e4ea5c8111