Let's start out this module by noting that we are basing our
instruction on the scenario that was covered in our Performing
Packet Sniffing Actions with Scapy module.
If you have just jumped into this module and want to review this scenario,
check out that quickly before moving forward.
So with that noted, with the previous module,
we covered how to collect information from the network live and via a
previous capture file. With this module, we move on from this and
assume you either have the packets that you want to extract information
from, and/or you are ready to build new packets based on either this
information or want to perform a specific task requiring the knowledge
to build packets.
So why do you need this knowledge? As a networking security
professional, one of the many duties that you need to perform is
analyzing the networking traffic that is being transferred to and from
the different hosts that you are responsible for.
Sometimes this is done for you with the various networking security
appliances that can be deployed, and sometimes things slip through these
because either those systems are configured correctly or the vector is new
and not able to be identified by them yet.
This is where tools like Python and Scapy, among others, can be used.
So to that end, with this section, we will run through how Scapy can
be used to display the information that was previously collected. To
do this, we will review several of the common commands and methods
that are available.
These will include show, summary, nsummary, hexdump,
filter, ls, show2, and sprintf.
Now let's run through these quickly.
The show method is used to display a representation of the
input variable or as a method of a variable.
The output will differ depending on the specific type of the
variable being referenced. With Scapy, there are a couple of
different types that can be seen.
These include one specific to a packet type,
for example, an Ethernet packet,
one specific to a list of packets, this is common when performing a packet
capture, and one that is specific to a send and receive list.
The summary method is used to display a summary of the packets
that are contained within the reference variable.
The nsummary method is a similar output to the summary,
but with the packet number appended to the beginning of the list.
The hexdump method can be used on packet lists or on send and receive
lists to display the variable in a hexdump format similar to what you
would see in the Bytes pane of Wireshark. The hexdump command can be
used to display a similar‑looking output or individual packet
variables referenced.
The filter method is used to parse the contents of a packet or a send and
receive list with a lambda function and output the results.
If not piped into a variable, the output will be shown on screen. If
piped into a variable, this variable can then be further parsed with the
other commands and methods discussed here.
The ls command can be used to display the contents of a packet
variable split into the individual fields,
field types, and field contents.
It is important to properly reference the packet view to have this work
correctly as it does not work on any type of packet list.
More information on this will be discussed in a few slides.
The show2 method is used to display an assembled packet view.
This is often used when creating new packets as the show method will display a
packet's contents without calculated fields like checksum.
The show2 method will calculate these checksums based on
the current contents of the packet. And the final method
that we will discuss is sprintf.
This method is used to format a variable based on a set of directives that
are similar to the class printf formatting. For example,
to output the TCP source port of every packet in a list, you would use
the command shown here where the variable is referenced inside the
quotes with an opening and closing ampersand. In this case, TCP.sport
references the intended field.
This is often used when you want to display information in a
specific format when looking for a pattern.
The last thing that we want to review in this section is about
how to reference specific packets inside the different common
variable types. For packets, you could use the discussed packet
methods covered directly.
For example, if a was an Ethernet packet type,
you could use the a.show command to show the contents of the
packet, or you could use the lsa command to display the same
information, but in a different format. If a was a packet list
that contained multiple packets, for example, from a capture,
then you can reference the individual packets by using a bracketed notation.
So a[0] would reference the first packet, and a[1] would
reference the second packet, and so on.
If a was a send and receive list of packets,
then each line entry contains a list of the successful sent
and received packets referred to as results, as well as a list
of the unanswered packets sent.
For reference, the first exchange's successful sent and received
packets could be referenced using Response [0][0], and to
reference the first unsuccessful packet,
you would use Response [1][0].
It is important to understand the specific type of variable you are
referencing to ensure you get the expected response.
The specific successful exchange packet from results can also
be referenced using an additional index.
For example,
the second successful sent packet could be referenced as
Response [0][1][0], and the second successful response would
be referenced as Response [0][1][1].
It is also possible to reference the same information, but split into
two different variables depending on the specific command being used.
As shown in the figure, when this is done,
the number of indexes required are lowered in place of different
variable reference names. In the next module, we will cover the
commands that can be used to send and receive traffic on the network
that will result in this type of packet list.
Another thing that we want to add before finishing up
is a note of the Wireshark command.
While Scapy is a very flexible, easy‑to‑use encode module,
it isn't always the easiest way to see all of the data
captured when attempting to perform analysis.
Wireshark is a well‑respected and free sniffing GUI that
is often used, and because of this,
Scapy provides a way to view the contents of a variable directly
within Wireshark by using the Wireshark command.
The input into this command is any of the variables discussed in this section.
So now to finish up,
how can this knowledge help you in your duties as a Globomantics network
security engineer? The ability to capture the traffic that is being
exchanged on your networks is important and was covered in the previous
module. In this section, we covered how to display this information in
multiple ways with your knowledge of network security and methods that are
used by various attack types.
This information can be used to isolate the attack,
find out what it is attempting to do, and then test your hypothesis on
lab equipment and then block it for being used. In our next section,
we will be moving into our demonstration environment and showing how
each of these different commands can be used and a review of the
expected output from them.