1

I've built a webcrawler that uses the HTMLParser lib in Python. It goes on a page, and continues with the next one, linked on the loaded page, etc. It just collects the links. Now I need to protocoll the TCP/IP traffic between the hosts and my PC (packet sniffing). The result should be stored in a file.pcap. I've found an' example that seems to be useful for my purpose. Am I right?

reference code!

Here the code of the answer I'm interested in:

from scapy.all import wrpcap, Ether, IP, UDP
packet = Ether() / IP(dst="1.2.3.4") / UDP(dport=123)
wrpcap('foo.pcap', [packet])
  1. Can this code be used for it? 2. If yes, how? 3. As parameters I've just the hostnames, but not dst(ip4-address) and the dport-data. It seems clear that 1.2.3.4 and 123 are just dummies to give an example.
Uwe_98
  • 697
  • 1
  • 8
  • 21

2 Answers2

3

It appears you are very unaware of what an IP or a port mean. You should start by reading articles about that.

http://mason.gmu.edu/~afinn/html/tele/components/urls_ip.htm https://searchnetworking.techtarget.com/definition/TCP-IP

Once this is done, have a read at the documentation to start with Scapy: https://scapy.readthedocs.io/en/latest/

Also: what is your question?

Do you want to :

Cukic0d
  • 5,111
  • 2
  • 19
  • 48
1

I am not familiar with Scapy, but I know how to get IP by addresses, you can ping it:

$ ping stackoverflow.com
PING stackoverflow.com (151.101.193.69): 56 data bytes
64 bytes from 151.101.193.69: icmp_seq=0 ttl=46 time=374.685 ms
64 bytes from 151.101.193.69: icmp_seq=1 ttl=46 time=397.401 ms
64 bytes from 151.101.193.69: icmp_seq=2 ttl=46 time=684.908 ms
64 bytes from 151.101.193.69: icmp_seq=3 ttl=46 time=301.389 ms

then you will know that stackoverflow.com's IP is 151.101.193.69

Tianxu
  • 61
  • 5
  • 1
    I don't know how this makes any sense. OP asked about the TCP ports, but obviously there are no ports in ICMP... -_- – Cukic0d Oct 16 '19 at 13:40
  • 1
    Yes it makes. There are 2 questions: One about url to ip conversion and a second is if there is a similar function as wrcap that takes an url as parameter. wrcap needs the IP and the port. Now meanwhile I've red a little bit and now I know that for http port 80 is the default and for https its 443, when I'm not wrong. – Uwe_98 Oct 16 '19 at 15:44