6

I recently began exploring Scapy. A wonderful tool indeed!

I have a problem... When I monitor my network card using Wireshark and I do a regular ping from the systems command prompt with the standard PING installation, wireshark pops up with "Ping request" and then "Ping reply" indication that it sent a reply. But when i do it manually in Scapy, it sends no reply back.. How can this be? I spent alot of time trying to figure this out so i really hope someone can shed some light on this issue of mine...

Here is the code i used:

>>> from scapy.all import IP, ICMP, send
>>> IP = IP(dst="127.0.0.1")
>>> Ping = ICMP()
>>> send(IP/Ping)

The packet is sent successfully and Wireshark shows a Ping request received, but not that it has sent a reply back.

Mike Pennington
  • 41,899
  • 19
  • 136
  • 174
Andesay
  • 229
  • 2
  • 4
  • 9

2 Answers2

8

This is an FAQ item:

I can't ping 127.0.0.1. Scapy does not work with 127.0.0.1 or on the loopback interface

The loopback interface is a very special interface. Packets going through it are not really assembled and dissassembled. The kernel routes the packet to its destination while it is still stored an internal structure. What you see with tcpdump -i lo is only a fake to make you think everything is normal. The kernel is not aware of what Scapy is doing behind his back, so what you see on the loopback interface is also a fake. Except this one did not come from a local structure. Thus the kernel will never receive it.

In order to speak to local applications, you need to build your packets one layer upper, using a PF_INET/SOCK_RAW socket instead of a PF_PACKET/SOCK_RAW (or its equivalent on other systems that Linux) :

>>> conf.L3socket
<class __main__.L3PacketSocket at 0xb7bdf5fc>
>>> conf.L3socket=L3RawSocket
>>> sr1(IP(dst="127.0.0.1")/ICMP())
<IP  version=4L ihl=5L tos=0x0 len=28 id=40953 flags= frag=0L ttl=64 proto=ICMP chksum=0xdce5 src=127.0.0.1 dst=127.0.0.1 options='' |<ICMP  type=echo-reply code=0 chksum=0xffff id=0x0 seq=0x0 |>>
Community
  • 1
  • 1
Martin v. Löwis
  • 124,830
  • 17
  • 198
  • 235
  • I found my answer in there. Apparently the loopback interface is "fake", i didn't know that. Thanks! – Andesay Nov 22 '10 at 15:44
  • What they mean by "fake" is that it never constructs Ethernet packets. Instead, IP packets are directly "transmitted" (i.e. copied) from the sender to the receiver. This is the whole point of the loopback interface. – Martin v. Löwis Nov 22 '10 at 15:52
0

Try this

def ping(host, repeat=3):
    packet = IP(dst=host)/ICMP()
    for x in range(repeat):
        response = sr1(packet)
        response.show2()

Your not storing the reply properly

Jakob Bowyer
  • 33,878
  • 8
  • 76
  • 91
  • Still didn't work.. Wireshark is only showing the request.. Here is a screenshot of a scapy ping: http://tinypic.com/r/27z9ru9/7 and here of a normal standard installation ping: http://tinypic.com/r/m7rleb/7 – Andesay Nov 22 '10 at 14:12
  • Are you sure that something is not blocking the response? – Jakob Bowyer Nov 22 '10 at 14:12
  • Hmmm i dont know what that should be when a normal ping is working.. I am using standard ttl, flags and so on could it be that? – Andesay Nov 22 '10 at 14:16