So now that we have reviewed the basics of how Scapy handles protocols through
the use of layers that can be stacked on top of one another,
let's move into our demonstration environment and see the
creation and dissection of packets.
For this,
we will begin by covering the basics of creating the different types of packet,
including IP, TCP, UDP, and ICMP.
We will then take a look at what these different
packets look like with the ls command,
and then we will move on to show the different fields
within these packets and how they can be displayed and
edited to the needs of the engineer.
The first thing we're going to do here is get back into Scapy,
and we're going to show the creation of the different types of packet,
and within Scapy,
this is actually made reasonably simple because it's done in layers which
mirror what the IP layers would be within a standard packet as every network
engineer and network security engineer learns.
So you have the ethernet layer that you can have,
you can have the IP layer,
the TCP and UDP or ICMP layers or any of the
different layers are supported by Scapy.
In this case,
what we're going to be doing is we're going to be showing the creation of
an IP packet and then we're going to show a TCP packet,
a UDP packet, and an ICMP packet.
So to get started,
first we're going to push all of these different packets into the a variable.
And in order to create an IP packet,
we just use IP all caps and then you can put parentheses,
and inside these parentheses,
we would specify the different fields and if we
wanted to change any of those fields,
but if we just wanted to create an IP packet,
we would just use that.
And as we've used the ls command before,
we can take a look at what this looks like.
So in this case we only have one layer, so it's not like split out,
and the only things that we have in here are the default
settings for all of these different field names.
So in this case,
we don't have any source and destination IP addresses that are specific,
it's only the loopbacks,
the TTL and all these other variables are all just sort of standard,
and generally,
you don't have to change a lot of these unless you're
trying to do something specific.
But if we wanted to sort of change what we're doing here,
if we wanted to specify the contents of each one of these fields,
we would do that inside this parenthesis.
So if we wanted to change the source IP address to,
and we have to do this inside quotes 10.10.10.101,
and if we wanted to send this packet to 10.10.102,
we could do that and hit Enter.
Now, if we use that same ls command here,
we will see that changed the entry for those two fields as shown here.
So that's basically about as simple as it is.
If we wanted to look at a specific field within that,
we could, since a is just one packet in this case,
we can use source or destination or TTL.
And since in this case, the variable that we're specifying,
in this case, a is only one packet, it's not a packet list,
that's how we would do that, and reference those different fields.
Now, if we wanted to make a TCP packet,
we could do that a couple of different ways.
We could do it, we wanted to stay we're still using a,
we wanted to put an IP layer on top of it,
and we want to put a TCP layer on top of it,
you just use the front slash, and then again,
use the parentheses.
So in this case, we're going to specify the source and destination IP addresses,
but we're not specifying any additional things within the TCP layer.
If we wanted to display that,
now we have two different layers and separated by those two hyphens.
What we'll see here is that Scapy automatically changed the protocol number,
the IP protocol number to 6 to acknowledge that.
Now it has a TCP layer on top of it.
We didn't have to change that.
Scapy automatically did that for us.
Now if we really wanted to confuse things,
we can change that to anything we want,
but Scapy is trying to work with you and trying to figure out how to
populate these different fields based on what you're giving it.
In this case,
well I'm trying to create a packet and I'm saying I
want a TCP layer on top of IP.
Well,
it makes sense for it to infer that you want to have that value
inside the IP portion of the packet as well.
It also shows some of the default values,
the default destination port is HTTP or 80.
The default source port is the FTP data port for some reason,
I'm not really sure why, but that's true.
And then all of the other things are just defaults.
In this case, the default flag, for example, for the TCP layer is a syn.
Now, another way to build this is you can sort of separate this out a little bit,
you can say okay, I want the first layer to be IP,
and the second one, I want to be TCP.
Now if we look at a, we see just an IP layer,
if we look at b, we see the TCP layer and we say c,
we want a, and we want to stack it on top of b.
So if we look at c, now we see the same output as we had before,
but if we looked at a, we'll see that in this case,
the protocol is 0 because it doesn't know yet what
that upper layer is going to be, so it doesn't know,
but whenever we created c, it,
Scapy knows that now we're putting a TCP layer on top of IP,
so then it knows how to deal with that.
Now if we wanted to put an Ethernet layer, we put an Ethernet layer there.
So now d is Ether, but I can say I want d,
we could look at e to be d and I want to put c on top of it.
But if we look at e, now we have three layers stacked on top.
We have the Ethernet layer, the IP layer, and the TCP layer.
And if we just looked at e by itself, you would see the Ethernet layer,
the IP layer, and the TCP, and if we ported that through the show command,
we could see it in a different format, little pretty in colored,
but similar output.
And this is also a good opportunity to show what the show2
command looks like whenever we're creating packets.
One of the things we'll notice here is the check sums
for both TCP and IP are set to none.
And the reason for that is it hasn't calculated them yet because it's waiting
for you to finish your modification of these different fields.
Now if we wanted it to calculate those things or we wanted
to see what those would calculate to, we would use show2,
instead of show.
And if we did that, it automatically calculates those different values.
Anything that's calculated,
it's going to show you what it would calculate those as.
So this is how the packet would be sent if we were to take it and send it
right now without any additional editing of the fields.
Then the editing of the fields is a different thing that we didn't cover.
And we are not limited to those fields being what they
were whenever we created the packet.
So if I wanted to change, if I was just working on e,
so this is e and I wanted to change the TCP flag to be
a syn ack instead of a syn only, we can do that.
We can say e.
and we want to change TCP layer, and we want to change flags,
and we want to make it equal to syn ack,
and then if we go back and look at the same thing,
we'll see that now that flags is set to syn ack now,
instead of syn.
So all of those different fields are individually editable.
So you can edit them at any point in time based on whatever you're seeing
and what you're trying to accomplish with the packets whenever you're
looking at them and then whenever you're sending them.
Usually whenever you're creating packets,
you're about to send them for some purpose.
So for example, in the next module,
we're going to cover how to use Scapy to create a traceroute
utility and a port scanning utility and part of that is going to
be creating the packets and sending them on a wire and showing
the response coming back.
So that's where a lot of these different things come in.
So now if we wanted to create a UDP packet, let's create an IP UDP packet.
So IP UDP, so now we show the default parameters that are in here.
We'll also see that Scapy automatically did the protocol auto selection again,
and we'll see the default values of the source and destination port
numbers for UDP which are set to the DNS port number of 53.
And again,
you can change any of these values either during creation or on the flight now.
So like I wanted to do a and I wanted to change the UDP source port,
you would do the bracket UDP, and I want to change the source port to,
you know, some random ephemeral port,
and I wanted to change the destination port to FTP,
and if we look at that again, we'll put this up higher,
we can see that now we have these two changed.
Interesting bug.
You'll notice this is not updating, but that's how to create a UDP packet.
As you want to imagine, an ICMP packet is just as simple.
So in this case, we have an IP ICMP packet.
The default fields are in here, in this case,
the default field is set to echo request,
and the default code is set to 0, which is the default for an echo request,
but none of the other fields are changed.
And just like any of the other packets, it's simple,
you can change whatever you want whenever you want.
So you can change it here, so if I wanted to say okay,
I wanted to change the type to a 3, you could do it on creation,
or you can edit that and ICMP type a and look at changes.
They're all pretty intuitive generally speaking,
even if you're not a programmer, most of this is pretty intuitive.
And obviously, we've been using the ls command throughout,
I prefer the ls command,
but you can also look at this with the other display commands.
So the show command would show it in that way,
we could show the show2 would automatically calculate the chksums for us.
So if we take a little bit closer look here,
sort of covered this while we were going through here,
we also have the ability to pull out these individual
fields into individual variables.
And at the command line, we probably tend not to do this as much,
but if you're using Scapy in a module form,
you would use it often.
So I wanted to say I want to take, for example,
the type field, the ICMP type field,
and I want to put that into a separate variable,
you can take that and say I want b to be an ICMP,
I've got to reference it correctly, the type field,
and I want that going into b, so b would show up with just 8,
and like I said, if you're using it inside the CLI,
you tend not to use it in that way very much,
but if you're using it inside a module and you want to say,
okay, take that value, put it in this module,
and run it through some ifs or whatever your logic is in order to figure out
what you want to do with that specific type of packet.
So if you wanted to say,
I wanted to take all ICMP traffic and then I want to take
all ICMP traffic that's an echo request,
and I wanted to print it out in a certain way and then send out
packets in a certain way based on those previous values,
you can do that with Scapy.
Basically,
it's as flexible or probably more flexible than
you're ever going to need it to be.
So now, as we've noted, usually, whenever we're creating packets in this context,
you're creating them to send them, and in this module,
we're not going to be covering the send commands that we're talking about.
So at this point,
we're going to move on from this demonstration and move into the next module
where we're going to be covering a couple different topics.
The first is going to be reviewing each of the different
send commands that are supported by Scapy.
So there are several of them depending on your specific needs.
That's the first section of that module.
The second section of that module is going to be covering,
well the second and third sections of that module are going to
be covering port scanning and traceroute.
So how those two applications can be implemented using Scapy.