We Keep Coding

Python sending package through wrong interface

I have a raspberry pi that is both connected to the internet via Wlan and a local device via Ethernet. So it has two IPs; one for each endpoint.
This is how it looks like simplified when running ifconfig; with different IPs for privacy
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 189.168.200.110 netmask 0.0.0.0 broadcast 255.255.255.255
wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 189.168.201.79 netmask 255.255.255.0 broadcast 192.168.1.255
This is the code that python is using to send a message to the device through the Ethernet with that gateway's ip
TCP_PORT = 3001
SERVER_IP_AD = "189.168.200.110"
CLIENT_IP_AD = "189.168.200.155"
BROADCAST_IP = "255.255.255.255"
def sendMessage(self, file_path, client_ip=CLIENT_IP_AD):
print('message en route')
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind((self.SERVER_IP_AD, 0))
s.connect((client_ip, self.TCP_PORT)) #**ERROR IS HERE**
MESSAGE = self.openFile(file_path)
s.send(MESSAGE.encode())
data = s.recv(self.BUFFER_SIZE)
s.close()
return data
Using wireshark I can see that the package is being sent through the Wlan interface instead of the Ethernet interface with the correct IP source and IP destination.
How do I tell python to use the correct interface when sending out the package?

In my opinion, you can establish Tcp connection with Ethernet, cause there isn't shaking hands by Ethernet
And, you shouldn't use s.bind() and s.connect() at the same time. Because the former is for UDP client, and the later is for TCP client. Have a try with only s.bind().

Python UDP Sockets with Multiple Interfaces

I'm Writing a script in python2.7 on a windows XP machine. The machine is connected to multiple networks using different network cards.
I'm running into an issue where I've bound a UDP Socket to a specific interface(I understand that you can accomplish this in windows by just providing the network cards existing IP address)
self.sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
self.sock.bind(('10.31.9.0', 6466)) #<<< 10.31.9.0 is address of desired card
I then set the timeout to 5s
self.sock.settimeout(5)
Then I try to send a message out to a server that I can prove exists and works. then wait for a response.
self.destintation = ('10.42.40.34', 62434)
# Send the msg
self.sock.sendto(msg, self.destintation)
# receive data
reply, addr = self.sock.recvfrom(1024)
However a socket.timeout is always thrown. so I open up wire shark to see what is going wrong, and it turns out that my initial message never gets sent on the desired interface.
What I do see is an arp broadcast on a different interface(10.10.10.12
) from my machine asking who is attached to my desired destination IP:
1 0.000000 IntelCor_8c:6d:97 Broadcast ARP 42 Who has 10.42.40.34? Tell 10.10.10.12
Of course there is no response to the broadcast because the 10.42.40.34 Address/machine is not reachable from the 10.10.10.12 interface
How do I tell Python to send the ARP broadcast out on '10.31.9.0'? What have I done Wrong?
EDIT:
Additional Information>
The network for the interface I am using is a Class B
(netmask is 255.255.0.0)
The interface IP is : 10.31.9.0
The target IP is: 10.42.40.34.
I am wondering if the issue is a result of my target sitting on a separate subnet. However, as described in a related issue here. there is traffic from the server to me... =/
UPDATE:
Results of "route PRINT 10*"
Active Routes:
Network Destination Netmask Gateway Interface Metric
10.0.0.0 255.0.0.0 10.10.10.12 10.10.10.12 10
10.10.10.12 255.255.255.255 127.0.0.1 127.0.0.1 10
10.31.0.0 255.255.0.0 10.31.9.0 10.31.9.0 10
10.31.9.0 255.255.255.255 127.0.0.1 127.0.0.1 10
10.255.255.255 255.255.255.255 10.10.10.12 10.10.10.12 10
10.255.255.255 255.255.255.255 10.31.9.0 10.31.9.0 10
Default Gateway: 153.4.84.1
===========================================================================
Persistent Routes:
None
UPDATE #2
Full route PRINT
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 153.4.84.1 153.4.85.81 10
10.10.0.0 255.255.0.0 10.10.10.12 10.10.10.12 10
10.10.10.12 255.255.255.255 127.0.0.1 127.0.0.1 10
10.31.0.0 255.255.0.0 10.31.9.0 10.31.9.0 10
10.31.9.0 255.255.255.255 127.0.0.1 127.0.0.1 10
10.255.255.255 255.255.255.255 10.10.10.12 10.10.10.12 10
10.255.255.255 255.255.255.255 10.31.9.0 10.31.9.0 10
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
153.4.84.0 255.255.252.0 153.4.85.81 153.4.85.81 10
153.4.85.81 255.255.255.255 127.0.0.1 127.0.0.1 10
153.4.255.255 255.255.255.255 153.4.85.81 153.4.85.81 10
192.168.56.0 255.255.255.0 192.168.56.1 192.168.56.1 20
192.168.56.1 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.56.255 255.255.255.255 192.168.56.1 192.168.56.1 20
224.0.0.0 240.0.0.0 10.10.10.12 10.10.10.12 10
224.0.0.0 240.0.0.0 10.31.9.0 10.31.9.0 10
224.0.0.0 240.0.0.0 153.4.85.81 153.4.85.81 10
224.0.0.0 240.0.0.0 192.168.56.1 192.168.56.1 20
255.255.255.255 255.255.255.255 10.10.10.12 10.10.10.12 1
255.255.255.255 255.255.255.255 10.31.9.0 10.31.9.0 1
255.255.255.255 255.255.255.255 153.4.85.81 153.4.85.81 1
255.255.255.255 255.255.255.255 192.168.56.1 192.168.56.1 1
255.255.255.255 255.255.255.255 192.168.56.1 5 1
Default Gateway: 153.4.84.1
===========================================================================
Persistent Routes:
None

Given the output from "route", it looks like you're 10.10.10.12 and 10.31.9.0 interfaces have been configured with overlapping subnets. The OS is choosing to use 10.10.10.12 for all 10.x.x.x addresses as it's the first rule that applies.
Having overlapping subnets is normally a network configuration error: it's probably intended that 10.10.x.x and 10.31.x.x are the valid subnets and both should use a netmask of 255.255.0.0, and so the current 255.0.0.0 netmask used by the 10.10.10.12 interface is incorrect.
(It may be possible to 'fudge' a fix, if the intention is to make all 10.x.x.x requests use the 10.10.10.12 interface except for those in 10.31.x.x which should use the 10.31.9.0 address, by changing the 'metric' of the 10.31.0.0 routing rule so that anything for 10.31.x.x addresses matches that rule before the 10.x.x.x rule is checked. You can use the route command to make that change, but it's definitely not recommended! Fixing the overlapping subnets is the proper solution.)

Turns out, the Packets that my "server" was sending where not IP kosher. so they where getting rejected at the network and transport layers. Solution was to not use python socket class, but instead communicate directly to OSI-L2 using winpcap and ctypes

How to split /etc/network/interfaces using a regex in Python

I'm trying to break the /etc/network/interfaces file format on Ubuntu to the individual stanzas (as the man page calls them).
This is the sample interfaces file I test my script against:
# The loopback network interface
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 192.168.2.7
netmask 255.255.255.0
network 192.168.2.0
broadcast 192.168.2.255
gateway 192.0.2.254
dns-nameservers 12.34.56.78 12.34.56.79
auto eth0:0
allow-hotplug eth0:0
iface eth0:0 inet static
address 192.168.1.43
netmask 255.255.255.0
auto eth1
iface eth1 inet dhcp
auto eth2
iface eth2 inet6 static
address 2001:db8::c0ca:1eaf
netmask 64
gateway 2001:db8::1ead:ed:beef
auto br0
iface br0 inet static
address 10.10.0.15
netmask 255.255.255.0
gateway 10.10.0.1
bridge_ports eth0 eth1
up /usr/sbin/brctl stp br0 on
What I need is an array of strings holding each stanza (iface, mapping, auto, allow-\w+, source(-\w+)? and comments) along with all the text that follows it until the start of next stanza.
I've tried code like this, which sounds like it should work, but it captures all stanzas in one string:
re.split(r'^(iface|mapping|auto|allow-\w+|source(-\w)?|#.*)[.\n]+?',
open('/etc/network/interfaces').read(), flags=re.MULTILINE)
How can I correct the regex to achieve this?
Python version is 2.7

You don't need a regex:
def stanza(fle):
with open(fle) as f:
vals = ("iface", "mapping", "auto", "allow-", "source")
tmp = []
for line in f:
if line.startswith(vals):
yield tmp
tmp = [line]
else:
tmp.append(line)
if tmp:
yield tmp
from pprint import pprint as pp
pp(list(stanza("foo.txt")))
Output:
[['# The loopback network interface\n'],
['auto lo\n'],
['iface lo inet loopback\n', '\n'],
['auto eth0\n'],
['iface eth0 inet static\n',
' address 192.168.2.7\n',
' netmask 255.255.255.0\n',
' network 192.168.2.0\n',
' broadcast 192.168.2.255\n',
' gateway 192.0.2.254\n',
' dns-nameservers 12.34.56.78 12.34.56.79\n',
'\n'],
['auto eth0:0\n'],
['allow-hotplug eth0:0\n'],
['iface eth0:0 inet static\n',
' address 192.168.1.43\n',
' netmask 255.255.255.0\n',
'\n'],
['auto eth1\n'],
['iface eth1 inet dhcp\n', '\n'],
['auto eth2\n'],
['iface eth2 inet6 static\n',
' address 2001:db8::c0ca:1eaf\n',
' netmask 64\n',
' gateway 2001:db8::1ead:ed:beef\n',
'\n'],
['auto br0\n'],
['iface br0 inet static\n',
' address 10.10.0.15\n',
' netmask 255.255.255.0\n',
' gateway 10.10.0.1\n',
' bridge_ports eth0 eth1\n',
' up /usr/sbin/brctl stp br0 on']]
If you want to remove the whitespace strip it off with line.strip().

How can I put mac os x en1 interface into monitor mode to use with python3 scapy?

On my mac the wireless interface is the en1 interface. I can put the interface into monitor mode using mac's airport application but then it doesn't work with the scapy module when i use python 3. How can i make this work?
Thanks in advance
ifconfig output
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
options=3<RXCSUM,TXCSUM>
inet6 ::1 prefixlen 128
inet 127.0.0.1 netmask 0xff000000
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
nd6 options=1<PERFORMNUD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=10b<RXCSUM,TXCSUM,VLAN_HWTAGGING,AV>
nd6 options=1<PERFORMNUD>
media: autoselect (none)
status: inactive
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
lladdr 00:3e:e1:ff:fe:0f:0a:4a
nd6 options=1<PERFORMNUD>
media: autoselect <full-duplex>
status: inactive
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
inet6 fe80::7ed1:c3ff:fe6e:eeda%en1 prefixlen 64 scopeid 0x6
inet 192.168.1.2 netmask 0xffffff00 broadcast 192.168.1.255
nd6 options=1<PERFORMNUD>
media: autoselect
status: active
en2: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
options=60<TSO4,TSO6>
media: autoselect <full-duplex>
status: inactive
p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304
media: autoselect
status: inactive
awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1452
inet6 fe80::18b8:64ff:fec8:85%awdl0 prefixlen 64 scopeid 0x9
nd6 options=1<PERFORMNUD>
media: autoselect
status: active
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=63<RXCSUM,TXCSUM,TSO4,TSO6>
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x2
member: en2 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 7 priority 0 path cost 0
nd6 options=1<PERFORMNUD>
media: <unknown type>
status: inactive
Python Script To Detected Packets (After putting en1 into mon mode using airport)
from scapy.all import *
def pktIdentifier(pkt):
if pkt.haslayer(Dot11Beacon):
print ("[+] Detected 802.11 Beacon Frame")
elif pkt.haslayer(Dot11ProbeReq):
print ("[+] Detected 802.11 Probe Frame")
elif pkt.haslayer(TCP):
print ("[+] Detected TCP Packet")
elif pky.haslayer(UDP):
print ("[+] Detected UDP Packet")
conf.iface = 'en1'
sniff(prn=pktIdentifier)
Output of conf.route
Network Netmask Gateway Iface Output IP
0.0.0.0 0.0.0.0 192.168.0.1 en1 192.168.0.7
127.0.0.0 255.0.0.0 0.0.0.0 lo0 127.0.0.1
127.0.0.1 255.255.255.255 0.0.0.0 lo0 127.0.0.1
169.254.0.0 255.255.0.0 0.0.0.0 en1 192.168.0.7
192.168.0.0 255.255.255.0 0.0.0.0 en1 192.168.0.7
192.168.0.1 255.255.255.255 0.0.0.0 en1 192.168.0.7
192.168.0.1 255.255.255.255 0.0.0.0 en1 192.168.0.7
192.168.0.7 255.255.255.255 0.0.0.0 en1 192.168.0.7
192.168.0.255 255.255.255.255 0.0.0.0 en1 192.168.0.7

Short Answer: You could MonkeyPatch the _PcapWrapper_pypcap class. An example Code is provided below.
Slightly Longer Answer: On Mac OS X scapy sniffs on interfaces through libpcap. Instead of calling pcap_open_live we call pcap_create, pcap_set_rfmon and pcap_activate (in this order). This will set the interface in monitor mode and start capturing. I tested the following MonkeyPatch under scapy-python3 (0.21) and macOS Sierra 10.12.6. Make sure you run this Code with admin rights.
from scapy.all import *
import scapy.arch.pcapdnet
from ctypes import POINTER, byref, create_string_buffer
from ctypes.util import find_library
class _PcapWrapper_pypcap_monkeypatched(scapy.arch.pcapdnet._PcapWrapper_pypcap):
def __init__(self, device, snaplen, promisc, to_ms):
self.errbuf = create_string_buffer(PCAP_ERRBUF_SIZE)
self.iface = create_string_buffer(device.encode('ascii'))
#self.pcap = pcap_open_live(self.iface, snaplen, promisc, to_ms, self.errbuf)
STRING = c_char_p
_lib_name = find_library("pcap")
if not _lib_name:
raise OSError("Cannot fine libpcap.so library")
_lib=CDLL(_lib_name)
pcap_create = _lib.pcap_create
pcap_create.restype = POINTER(pcap_t)
pcap_create.argtypes = [STRING, STRING]
pcap_set_rfmon = _lib.pcap_set_rfmon
pcap_set_rfmon.restype = c_int
pcap_set_rfmon.argtypes = [POINTER(pcap_t), c_int]
pcap_activate = _lib.pcap_activate
pcap_activate.restype = c_int
pcap_activate.argtypes = [POINTER(pcap_t)]
self.pcap = pcap_create(self.iface, self.errbuf)
pcap_set_rfmon(self.pcap, 1)
pcap_activate(self.pcap)
self.header = POINTER(pcap_pkthdr)()
self.pkt_data = POINTER(c_ubyte)()
self.bpf_program = bpf_program()
scapy.arch.pcapdnet._PcapWrapper_pypcap = _PcapWrapper_pypcap_monkeypatched
def pktIdentifier(pkt):
if pkt.haslayer(Dot11Beacon):
print("[+] Detected 802.11 Beacon Frame")
elif pkt.haslayer(Dot11ProbeReq):
print("[+] Detected 802.11 Probe Frame")
sniff(iface="en0", prn=pktIdentifier)

When using the sniff function setting monitor=True on Mac OS Catalina always works for me. Example: scapy.all.sniff(iface='en0, monitor=True) then obviously what ever other functions you want.

This is a possible answer: http://www.cqure.net/wp/2014/04/scapy-with-wifi-monitor-rfmon-mode-on-os-x/
If you will file a bug on http://github.com/phaethon/scapy I will assist with patching part.

how to get IP adress of a Host if its Mac address is known using python / scapy

How can i get the IP address of a computer if its mac address is known , using python and scapy may be

You might use the information from the arp cache:
> arp -a
localhost (10.37.129.2) at 0:1c:42:0:0:9 on vnic1 ifscope permanent [ethernet]
localhost (10.37.129.255) at ff:ff:ff:ff:ff:ff on vnic1 ifscope [ethernet]
localhost (10.211.55.2) at 0:1c:42:0:0:8 on vnic0 ifscope permanent [ethernet]
localhost (10.211.55.255) at ff:ff:ff:ff:ff:ff on vnic0 ifscope [ethernet]
fritz.slwlan.box (192.168.0.1) at 0:4:e:2b:28:16 on en1 ifscope [ethernet]
Either you parse the result of "arp -a" on Unix yourself or look at
http://libdnet.sourceforge.net/dnet.html
providing access to the ARP cache from Python.

Perhaps you could use arp-scan, but then you'd have to run as root:
$ arp-scan --interface=eth0 --localnet
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.5.2 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.1.1 00:c0:9f:09:b8:db QUANTA COMPUTER, INC.
192.168.1.4 00:02:b3:bb:5c:09 Intel Corporation
192.168.1.3 00:02:b3:bb:66:98 Intel Corporation
192.168.1.5 00:02:a5:90:c3:e6 Compaq Computer Corporation
192.168.1.6 00:c0:9f:0b:91:d1 QUANTA COMPUTER, INC.
192.168.1.8 00:02:b3:3d:13:5e Intel Corporation
...
34 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.5.2: 256 hosts scanned in 1.717 seconds (149.10 hosts/sec). 33 responded