Python Scapy http sniffer clarification

Question

I was trying to understand how to make a http sniffer in python scapy here's a code which I'm trying to understand

#!/usr/bin/python
from scapy.all import *

def http_header(packet):
        http_packet=str(packet)
        if http_packet.find('GET'):
                return GET_print(packet)

def GET_print(packet1):
    ret = "***************************************GET PACKET****************************************************\n"
    ret += "\n".join(packet1.sprintf("{Raw:%Raw.load%}\n").split(r"\r\n"))
    ret += "*****************************************************************************************************\n"
    return ret

sniff(iface='eth0', prn=http_header, filter="tcp port 80")

But I can't understand what GET_print function exactly do actually I know what join() and split(r"\r\n") should do in simple way but I don't know sprintf("{Raw:%Raw.load%}\n") doing Here and when it come to tie it all together i don't get it

Simply I want a simple clarification of what this line "\n".join(packet1.sprintf("{Raw:%Raw.load%}\n").split(r"\r\n")) must do

NOTE Here's where I got this code :HTTP GET packet sniffer in Scapy

score 0 · Answer 1 · answered Jul 17 '17 at 17:10

0

sprintf is just a useful method available on Scapy packets which lets you construct a string in a format you specify, and fill it with the data from the packet that you want. See here for an explanation. %Raw.load% specifies that you want the raw payload in the packet -- which here will correspond to the HTTP request string ("GET / HTTP/1.1 ....").

answered Jul 17 '17 at 17:10

viswajithiii

449
4
8

Great It is much clearer now, but how `join()` and `split(r"\r\n")` works to gather to get the readable out put ?. – l0k0 Jul 17 '17 at 17:21
1

HTTP responses have different sections separated by `\r\n`, by convention. Calling `split('\r\n')` on the string produced by `sprintf` creates a list of strings, with one element for each part, and then `'\n'.join` creates a string by joining the elements of this list with a `'\n'` (newline character) between them. For example, if you have a string `s = "a\r\nb\r\nc"`, `s.split(r"\r\n")` will give you a list `["a", "b", "c"]` and `'\n'.join()` gives you a new string `"a\nb\nc"`. – viswajithiii Jul 18 '17 at 10:59

Python Scapy http sniffer clarification

1 Answers1