We Keep Coding

Read raw ethernet packet using python on Raspberry

I have a device which is sending packet with its own specific construction (header, data, crc) through its ethernet port.
What I would like to do is to communicate with this device using a Raspberry and Python 3.x.
I am already able to send Raw ethernet packet using the "socket" Library, I've checked with wireshark on my computer and everything seems to be transmitted as expected.
But now I would like to read incoming raw packet sent by the device and store it somewhere on my RPI to use it later.
I don't know how to use the "socket" Library to read raw packet (I mean layer 2 packet), I only find tutorials to read higher level packet like TCP/IP.
What I would like to do is Something similar to what wireshark does on my computer, that is to say read all raw packet going through the ethernet port.
Thanks,
Alban

Did you try using ettercap package (ettercap-graphical)?
It should be available with apt.
Alternatively you can try using TCPDump (Java tool) or even check ip tables

How to capture the packets that you send in Scapy?

I am sending packets using:
send(IP(dst="192.168.1.114")/fuzz(UDP()/NTP(version=4)), loop=1)
But I am not able to capture these packets in any other nearby machine (including the one with IP 192.168.1.114) which is on the same network. I am using wlan as my interface.
I also tried to sniff and then replay using scapy but I am still not able to capture those packets.

i would first try to capture the traffic on the sender machine with tcpdump while executing your program:
tcpdump -i any udp dst 192.168.1.114
if you can see the traffic leaving the source host it may be that it does not arrive on the target host. UDP packets are the first packets to be dropped by any network device and as it is the nature of UDP it wont get retransmitted. if you are sure the packet leaves the source verify if it arrives at the target:
tcpdump -i any upd dst 192.168.1.114
Another point to check is your firewall settings. It could be either on the source or target system that your firewall is blocking those requests.

I finally resolved this. Here is the checklist I made which might help others when dealing with replaying/fuzzing using scapy.
Check if all IP addresses you are dealing with are alive in the
network (use ping)
Understand the difference between send() (layer 3)and sendp() (layer 2)
If mutating existing packet make sure to
remove the checksum (using 'del') and recalculate the checksum
either using show2() or using str to convert packets to string
and then converting them back to packets

You should use Wireshark, or the sniff function in Scapy and make it pretty print the contents on the screen:
sniff(lambda x:x.show())

Python Scapy Intercept Packets before sending them on

I have three virtual machines all on Centos 6.5.
The current setup is as follows:
A ------(eth0) B (eth1)------- C
Currently, when A pings C, it is routed through B as they are on different networks.
I want to write a script using python and scapy (Used on machine B) that will intercept the packet that passes through eth0.
By intercepting the packet, I can hold it for some time (delay) or do some packet manipulation.
I then want to send the packet to its destined destination.
Does anyone know how I can intercept packets before they reach their end destination using Python and Scapy?
I have read a lot about Netfilter and iptables but not exactly sure how I can intercept the packets and change them.
Thank you in advance

python sockets and a serial to IP device

Using a Lantronix UDS-1100 serial to IP converter. The goal is to write a small proof of concept piece in Python to capture serial data output by this device over IP.
I've done a couple test projects using sockets in python, but they were all done between python processes (python > python): listen() on one end, and connect(), sendall() etc on the other.
I think I can use sockets for this project, but before I invest a bunch of time into it, wanted to make sure it is a viable solution.
Can python sockets be used to capture IP traffic when the traffic is originating from a non-python source? I have full control over the IP and port that the device sends the serial data to, but there will be no python connect() initiated by the client. I can pre-pend then serial data with some connect() string if needed.
If sockets won't work, please recommend another solution...guessing it will be REST or similar.

Of course. TCP/IP is supposed to be cross-platform and cross-language, so in theory you should be able to communicate with every kind of device as long as you manage to process and send the expected protocol.

How do I send an ARP packet through python on windows without needing winpcap?

Is there any way to send ARP packet on Windows without the use of another library such as winpcap?
I have heard that Windows XP SP2 blocks raw ethernet sockets, but I have also heard that raw sockets are only blocked for administrators. Any clarification here?

There is no way to do that in the general case without the use of an external library.
If there are no requirements on what the packet should contain (i.e., if any ARP packet will do) then you can obviously send an ARP request if you're on an Ethernet network simply by trying to send something to any IP on your own subnet (ensuring beforehand that the destination IP is not in the ARP cache by running an external arp -d tar.get.ip.address command), but this will probably not be what you want.
For more information about raw socket support see the TCP/IP Raw Sockets Docs page, specifically the Limitations on Raw Sockets section.

You could use the OpenVPN tap to send arbitrary packets as if you where using raw sockets.