0

I'm trying to perform http QoS with scapy. For the scanner, I need to get the connection time, the time between my GET, the begin of datas sent (the ACK from the server) and finally: the end of data.

I have written that:

    port=RandNum(1024,65535)
    HOST=a[0][0][1][DNS].an.rdata
    syn = IP(dst=HOST) / TCP(sport=port, dport=80, flags='S', seq=42)
    syn_ack = sr(syn, verbose=0)
    t1 = (syn_ack[0][0][1].time - syn_ack[0][0][0].sent_time)*1000

    getStr = "GET / HTTP/1.1\n\n"
    filt = "tcp and host {ip}".format(ip=HOST)
    request = IP(dst=HOST) / TCP(sport=syn_ack[0][0][1][TCP].dport, dport=80, flags='A', seq=syn_ack[0][0][1][TCP].ack, ack=syn_ack[0][0][1][TCP].seq + 1) / getStr
    reply = sr(request, verbose=0)
    http_fin = sniff(filter=filt, count=1)
    t2 = (reply[0][0][1].time  - reply[0][0][0].sent_time)*1000
    t3 = (http_fin[0].time - reply[0][0][1].time)*1000

    fin_ack = IP(dst=HOST) / TCP(flags="FA", ack=http_fin[0][TCP].seq+1, seq=http_fin[0][TCP].ack, sport=http_fin[0][TCP].dport, dport=http_fin[0][TCP].sport)
    send(fin_ack, verbose=0)

In wireshark, I can see after my GET, an ACK packet (catched by "reply = sr(request, verbose=0)") and after an HTTP packet (like HTTP /1.0 200 OK) which must be the end of response.

My problem is that, sometimes, this HTTP packet come BEFORE the sniff line was interpreted (http_fin = sniff(filter="tcp and host 88.191.132.65", count=1), so these command waiting for nothing.

I think maybe I can catch 2 packets with sr command but I'm not sure. Anyone see another way?

user1789326
  • 141
  • 1
  • 3
  • 8

1 Answers1

2

you can specify multi=1 when calling sr() to receive multiple 'answers' the same sent packet. but looks like you need to specify a timeout= as well.

kirelagin
  • 13,248
  • 2
  • 42
  • 57
abc def
  • 21
  • 2