With this section,
we will now move on from the specific commands and methods that are
supported to display the information contained within a packet and
packet list variables and get down into the creation and dissection of
individual packets and their fields.
If you have come to this module after watching the previous course,
Network Basics with Python,
you will be familiar with how Python and the socket module can
be used to both send and receive traffic.
What you will also know is that to do this with the socket module
requires a good amount of raw packet processing.
With Scapy,
this processing is built into their libraries and the process of
referencing these individual fields has been simplified.
The selection of the socket or Scapy module or both will come
down to your specific needs of these tools.
Within this section,
we will show how to reference these specific fields using the Scapy module.
To do this in this initial slide section,
we will quickly review the different structures
that make up the common Ethernet, IP, TCP,
UDP, and ICMP parts of a packet,
as well as a review of how to build a packet from scratch.
In the demonstration, we will show you how to build packets,
as well as display packets using the commands referenced in the
previous section and then show how to pull out and push back the
values for specific fields within these parts.
So with that noted,
how do you think this process could help in your job as a
Globomantics network security engineer.
At the CLI,
often this information is helpful to quickly determine how the
traffic is structured and where it is coming and going,
but where the ability to extract and push back these
different fields comes in is when it is used as a module
inside a larger Python program.
As some of the following modules will show,
these abilities will allow you to perform specific tasks that are
often left to already established programs.
For example, a program like Nmap can be used to perform a port scan,
but this same functionality can also be performed by Scapy with a much
finer level of control. What this and the following section will provide is
an explanation of how the basics are performed,
which will then be built on top of with these later modules.
The first thing that we want to review is the way that Scapy handles the
different potential layers that can exist within a packet.
Scapy uses the term layers to organize the contents of a packet.
So for a typical TCP packet, a capture may show four different Scapy layers.
The first is the Ethernet or ether layer,
the second would be the IP layer, the third layer would be the TCP layer,
and the fourth is referenced as raw and is the contents of the TCP data field.
For our example shown here,
we have displayed a captured TCP packet from the local
network and omitted the data portion for space.
If we wanted to build a packet similar to this one, we could do that as well.
For this example, we will enter the command shown here.
This packet is a TCP packet that is built on top of two other layers,
including an Ethernet layer and an IP layer.
With these,
we are altering the default values of a few fields to direct the
packet to a specific host located at 192.168.1.165.
In this case, the packet is being directed at TCP port 22 or the SSH port.
What you may also notice is that this packet is being
pushed into the packet variable.
This is then used to edit its contents or to send the packet.
Now if we want to take a look at what this packet looks like,
we can use the ls command.
What you may notice is that Scapy automatically filled in
some of the blanks in this structure.
For example, we didn't specify that the Ethernet ether type was IP,
but it filled that in.
We didn't specify that the IP protocol was TCP, but it filled that in.
Scapy will try its best to determine what you are trying to
do and fill in the blanks where it can.
For the rest of the required fields,
default values are entered. What this figure will also show you
is an additional example of the output of the ls command that was
covered in the previous sections.
The next question is how are all of these different fields
organized and how are they referenced?
So now let's start answering these questions with a quick
look at the structures that make up most common networking
traffic starting with Ethernet.
If we look at this figure,
we will see at the top that the Ethernet header is
composed of three main header fields.
These include the destination and source MAC address and the
Ether type of the data that is contained within the data
portion of the Ethernet frame.
At the bottom,
we will see output of the Scapy ls command when viewing an Ethernet packet.
The first field in each line is the variable that can
be referenced from within Scapy.
So in this case, to reference the source MAC address field,
we would use the a [12] .src variable.
Now let's take a look at the IP header.
The IP header contains a number of different fields,
and thus we can't show this image and the Scapy image in the same slide.
For IP,
there are multiple fields that are commonly referenced
including the source and destination IP addresses,
but every field that is shown in this header is
referenceable and editable by Scapy.
With the output of the Scapy ls command,
we can look at what the IP portion looks like.
As you can see,
the first field is still showing the variable name that can be referenced.
How to reference these variables specifically will depend on the
structure of the packet or packet list variable.
In our case displayed here,
there is an existing Scapy Ethernet layer that is also
captured that sits on top of the IP layer.
Because of this,
Ethernet variables can be referenced with only the
main list name and the variable name.
To reference the IP source variables, in our case,
we would need to use a [12][IP] .src that indicates the 13th
packet in the list as packets are indexed from 0,
the IP layer, and then finally, the SourceIP address field.
Next we have the TCP header.
The TCP header also contains a number of fields as shown in the figure,
and just like IP to keep it readable,
we have split the Scapy display into the next slide.
For this figure, we again look at the output of the Scapy ls command.
In this case, we have isolated the TCP portion.
Just like with IP,
the specific way to reference TCP will depend on the
structure of the variable being parsed.
In this case, the packet list is a and we are viewing the 13th packet,
or TCP, if we wanted to reference the contents of the sequence number field,
we would need to use a [12][IP][TCP] .sequence,
or seq, or a [12] [TCP] .sequence,
or seq if there is no overlap in the header field name.
Now we move onto UDP.
The UDP header is quite simple compared to the IP and TCP
headers with only four fields to reference.
In this case, we are looking at the seventh packet from the list,
and here we can see the different fields that can be
used to reference those header values.
So to reference the destination port field directly,
we would use a [6][IP][UDP] .destination port,
or dport, or a [6][UDP] .dport if there is no overlap with the header field name.
And finally we have ICMP.
As we can see here,
it looks like the ICMP header is simpler than any of
the other protocols covered here.
However,
this is just the common header fields that are used with
all ICMP packet and message types.
ICMP has a number of different configurations of header,
depending on the specific code and type being used.
This is why there are so many additional fields shown here
when using the ls command on an ICMP packet.
Then Scapy was built with flexibility in mind, most of the common
ICMP code and message type header configurations are supported
should you require to utilize them.
For ICMP, if we wanted to reference the contents of the type field,
we would need to use the a [4][IP][ICMP] .type or a [4][ICMP] .type
if there is no overlap in the header field name.
So now let's move on and into the next section where we will be moving
back into the demonstration environment and showing the creation and
editing of packets based on the reviewed methods.