3

I have seen several examples of creating sockets to sniffing for IP Packets, for example using: 

s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_IP)

What I am trying to achieve, is sniffing for Ethernet Frames and analysing the data received in Windows. The packets I am interested in are PPPoE Frames not containing IP.

In Linux (using python) I was able to achieve this using : 

s = socket.socket(socket.PF_PACKET, socket.SOCK_RAW, socket.htons(3))
s.setsockopt(socket.SOL_SOCKET, IN.SO_BINDTODEVICE, struct.pack("%ds"%(len("eth0")+1,),"eth0"))
while condition:
    pkt = s.recvfrom(1500)
    addToQueue(filter(pkt))

Now due to the differences betweeen linux sockets and WinSock2 API, I am having the following compatibility issues :

  • There is no IN package for windows. That means the SO_BINDTODEVICE is not present. How do I sniff everything coming on eth0 interface?
  • What should I use for protocol option in socket() constructor as I dont want to limit it to IPPROTO_IP.

Can anyone point me to the right direction ? I went through similar questions but none of them really solved my problem as they were all concerned with IP Packet sniffing

Note: I know libraries like Scapy could be used for sniffing, but it loses packets if we are trying to do any elaborate filtering (or use the prn function) and does not suit what I am trying to do. Raw sockets fit my need perfectly.

4

2 回答 2

2

如果没有 Windows 框，我无法验证这一点，但我认为您所需要的只是......

HOST = socket.gethostbyname(socket.gethostname())
s = socket.socket(socket.AF_INET, socket.SOCK_RAW)
s.bind((HOST, 0))
s.ioctl(socket.SIO_RCVALL, socket.RCVALL_ON)
while condition:
    pkt = s.recvfrom(1500)
    addToQueue(filter(pkt))

此外，我建议您考虑改用 pypcap（或另一个 libpcap 包装器）之类的东西。

于 2011-06-03T18:38:30.720 回答
0

FTR

注意：我知道像 Scapy 这样的库可以用于嗅探，但是如果我们尝试进行任何精细过滤（或使用 prn 函数）并且不适合我想要做的事情，它会丢失数据包。原始插座非常适合我的需要。

如果你得到 Scapy 和 set conf.use_pcap = False，你可以创建一个 Windows 原始套接字sock = conf.L2socket()，根据你自己不会“丢失数据包”。

然后，如果您真的不想使用 Scapy 的解剖，您可以像普通套接字一样调用recv()或调用它。recv_raw()

于 2019-10-16T20:27:07.870 回答