So now that we've reviewed the different parameters that are supported with
the Scapy sniff command along with the wrpcap command,
we can move into the fun part and see how this all works
in a live demonstration environment.
Remember that in the context of this course,
you are a new hire for Globomantics and part of your appeal is having
the ability to work with these different new tools and put them in
place where they can be the most useful.
With that in mind,
imagine how each of these different parameters could be used in a real
environment and how you could make these work in your favor.
For this section,
we will be reviewing each of these different parameters in
order starting with the count parameter and working our
way through to the timeout, iface, filter,
lfilter, prn, and then offline.
We will then finish up by saving our newly captured
packets by utilizing the wrpcap command.
Now let's move into our demonstration environment and show how each of these
different parameters with the Scapy sniff command works.
First thing we need to do is get into Scapy,
we can also clear this so we have the whole screen,
and the first thing that we're going to do is we're going to take a
look at the sniff command itself and then we're going to move
through each of these different parameters.
So the sniff command by itself without any other parameters is simply
just running the command with two little parentheses.
Now, if we run that,
as we've noted before without any other additional
parameters or anything going on,
it's just going to sit there and indefinitely just
capture what's going on on the wire.
If we cancel out of that or break out of that,
we will see that in that amount of time we have captured 6 UDP packets.
Since we have not specified that these different packets will be
pushed into a different variable at this point,
we don't have anything else to play with,
then take a look at what these packets were that were captured.
In order to do that with Scapy,
we would use the underscore which is used to represent
the previous output of the command.
So in this case, if we wanted to put it in the a variable,
we would say a= and then an underscore and hit Enter.
And if we look at a, and we just display a,
we'll see that it just shows up with the same six UDP packets that are captured.
Let me take a quick look here and we'll see that those six packets
that were captured were just NTP and DNS lookups,
but that's basically sniff really,
really simply. But normally, we're not wanting it to just go
out and sniff on the wire indefinitely,
so how we parse out what we actually want to do on the wire,
we can use these different parameters that we covered in the last section.
So the count parameter is one of the ones that's the most
obvious to do first because it just specifies a specific
packet count that it will capture to, and at that point,
it will break out of the sniff function.
So if we say sniff count and let's just use 20.
So if we just hang out here for an indefinite amount of time,
or however long it's going to take, for those 20 packets to be captured,
we could sit here.
A faster way to do it, and in our case,
we're just going to ping over to another local one,
and we're going to create our traffic.
So in this case, as you can see, it captured 10 UDP packets,
and 8 ICMP packets, and 2 other packets.
And if we take that and we pipe, if we would have put it into a variable,
we'd see that, and if we see a, we want to just do real quick,
this is what we saw and we can see that we captured some more DNS packets,
some more NTP packets, an ARP request and response,
and then some other ICMP, echo, and echo‑replies,
which is the traffic that we pushed through.
Pretty simple by itself.
So the next question is how how could we use the sniff command
and run it for a specific amount of time?
If we wanted to do that,
let's just pipe this output into the B variable and say sniff then a timeout,
which was the second variable that we reviewed,
and say we're going to do this for 10 seconds, and then just hit Enter.
So at this point, regardless of how many packets it captures,
whether that's 0 or whether that's 100,
it's only going to sit here and capture the stuff on the wire for 10 seconds.
Now, if we look in that 10 seconds, we pulled 7 different packets.
So, and that's how we use the timeout,
it's just to specify the amount of time in seconds
that we want the sniff to run.
Now the third thing we're going to cover here is of the iface,
or the interface, parameter.
In this case, we only have, you know, other than the loopback,
we only have one interface.
So we can see from that output that I forgot to put the
little brackets around the interface name.
So now that we put the brackets around the interface name,
it'll sit here and only watch for that specific interface
and try to count for 10 different packets that go through
on that specific interface.
We captured those 10 and there is the 10 that were captured.
We can also take that and, you know, specify a timeout on top of this,
let's say for 10 seconds.
Instead of doing a count,
we could do a timeout and only capture on a specific
interface for a specified amount of time.
So those 10 seconds will be up here, and in that 10 seconds,
those are the packets that we captured off the wire.
Well the next parameter is the filter parameter which
is very powerful and very important.
But the filter,
if we wanted to use the sniff command and we wanted to let's just put
a timeout on it so we're not sitting here forever,
and then we wanted to say a filter.
So what does this filter do and how is it organized?
So for that,
we can move over to this PDF reference sheet that I had noted in the slides,
but in this case this is the BPF, or the Berkeley Packet Filter,
language or syntax that you can use for these different things.
And these are all the different keywords that you can use
to further pare down the traffic that you want the sniff
command to pay attention to.
Now remember the filter parameter is specifying a filter
that the operating system is doing for you before Scapy
sees any of the traffic at all.
So in that case,
it bypasses some of the performance problems that you would
normally have with Scapy because all that filtering is done as fast
as the operating system can deal with it.
So, if you wanted to specify a specific filter,
and in this case, we're going to specify a source,
we're going to say,
I only want to see the traffic that's coming from 10.10.10.102.
And in this case,
we're only going to be doing that specific capture for 10 seconds.
So one of the things that we did in the background before we did any of
these commands was I started up a ping from this machine,
the 102 machine, and I said to ping this local machine,
which in this case is 101.
So we're going to see some ping traffic coming in
whenever we see the output of this command,
We'll see a whole bunch of echo requests that come in from 102.
So just as easily, we could turn this around and say we want to see
ones that have a destination address of 10.10.10.102.
And since this ping is running in the background continuously,
what we will see is a whole bunch of messages that are echo replies.
So really, the filter command,
I mean this is just showing a very quick representation of what's possible,
but it can be as complex or as simple as needed,
but it is highly recommended to use the filter command at a,
even at a high level to say from a specific network,
for example,
in order to ensure that the performance of Scapy is and you end up
getting the results that you're actually going to expect.
So next,
we're going to take a look at the lfilter parameter and remember the lfilter
parameter is not the exact same thing as the filter parameter.
The filter parameter will use that BPF filtering
similar to Wireshark or tcpdump, and it is performed by the operating system.
The lfilter parameter is not done by the operating system.
It is actually done by Scapy itself, and because of this,
is somewhat limited in terms of performance,
but it does allow you to have a little bit more control
over what the filtering possibilities are.
So in this case, we're going to do this one and what this specific command does,
the lfilter, and what we're passing into that is a lambda function x,
and we're saying we want to see only the traffic
that's ICMP that has an ICMP type of 8, which is an echo request.
We also have the filter parameter on here which does do some of
our filtering on the operating system side,
and we are also specifying an lfilter,
so how this works in terms of workflow is the packets will be screened
through the BPF filter saying only traffic that's ICMP and then it will be
filtered through the lfilter that says I only want to see traffic that has
an ICMP type of 8 so it goes in that order.
And then on top of that,
we're adding a timeout of 10 seconds, so only give me
ICMP traffic that has an ICMP type of 8 and whatever
traffic is within that 10 seconds.
And then keep in mind that ping is still going on in the background
so we should get a decent amount of ICMP traffic.
So if we take a look at this variable,
we'll see that the only traffic that was received were those echo requests,
which are an ICMP type of 8.
So next what we're going to do is we're going to
take a look at the PRN parameter,
and what the PRN parameter does for the sniff command is it specifies a
function that will be run for every packet that is captured.
So it's usually paired together with the lambda.
So in this case, for every packet that comes in,
it's going to run the spin off, the sprintf function,
and it's going to control what we're actually seeing as the sniff is going on.
So in this case, it shows the IP source address for every packet that comes in.
Now, if we look at the variable itself,
it still shows all of the information that would be normal and capture it.
It doesn't limit what's being captured in here to the variable,
but it does control what is shown at the CLI.
So the last parameter that we're going to take a
look at is the offline parameter,
and what the offline parameter allows you to do is it allows you to take a
capture file and it allows you to import them into the Scapy,
into a Scapy format that you can then move around and take a
look and utilize the flexibility with Scapy.
So we add a pcap file named testcap.pcap,
and these are the different packets that we
captured at some other point in time.
And we can pull them into Scapy, and from here,
we can further look through each one of these packets individually,
look through the different fields that come with each one of these,
or we can replay the packet list back out on the wire,
which we'll see in a later module as well.
So the reverse of this,
so if we wanted to take packets and we wanted to create a pcap file
because we wanted to look at it with another utility,
that would be done with a wrpcap command.
If we wanted to go back a capture here,
we were looking at these different ICMP packets that we
got on one of the previous shows,
and we wanted to move those off into a separate file,
we could use the wrpcap command, and the first one here is the file name,
so icmpcapture.pcap and then the second parameter that you put into
this command is the variable which contains the packet list that
you want to push off into that file.
And if I actually spelled it correctly, you'd have no output coming back here,
but we would see that we now have an icmpcapture.pcap file.
So with that,
we have completed covering the different items that we
wanted to cover from this specific module,
but in the next module,
we're going to move on and show all of the different common
display commands that are available on top of also showing how to
create and dissect different packets.