Geek asks and answers

Pawon Raw Sockets (Windows): Flash Flash Frames

I saw several examples of creating sniffing sockets for IP packets, for example using:

s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_IP)

What I am trying to achieve sniffs for Ethernet frames and analyzes the data received in Windows. I am interested in packets that do not contain IPPoE frames .

On Linux (using python), I was able to achieve this using:

s = socket.socket(socket.PF_PACKET, socket.SOCK_RAW, socket.htons(3))
s.setsockopt(socket.SOL_SOCKET, IN.SO_BINDTODEVICE, struct.pack("%ds"%(len("eth0")+1,),"eth0"))
while condition:
    pkt = s.recvfrom(1500)
    addToQueue(filter(pkt))

Now, due to the differences between linux sockets and the WinSock2 API, I have the following compatibility issues:

  • There is no IN package for windows. This means that SO_BINDTODEVICE is not. How do I sniff everything that goes into eth0?
  • socket(), IPPROTO_IP.

- ? , , IP-

. , , Scapy, , , - ( prn) , . .

+3
2

Windows, , , , ...

HOST = socket.gethostbyname(socket.gethostname())
s = socket.socket(socket.AF_INET, socket.SOCK_RAW)
s.bind((HOST, 0))
s.ioctl(socket.SIO_RCVALL, socket.RCVALL_ON)
while condition:
    pkt = s.recvfrom(1500)
    addToQueue(filter(pkt))

, - pypcap ( libpcap).

+2

FTR

. , , Scapy, , , - ( prn), , . .

Scapy conf.use_pcap = False, Windows, sock = conf.L2socket(), , , " ".

recv() recv_raw() , , Scapy.

0

More articles:


All Articles