For this module,
we will be talking about the steps that are required to perform
port scans and traceroutes using Python and Scapy.
Well in the previous module,
we covered how to create and manipulate packets to your requirements.
With this module,
we will continue our adventure about talking about port scans and traceroutes,
but we first need to cover how to send and receive traffic in the first place.
Because of this,
we will begin this module with a slide and demonstration section
covering the basics of sending and receiving packets.
So why do you think you would need this knowledge?
As a networking security professional for Globomantics,
one of your many duties that you will have will include the use of a
variety of different tools that help fill out your picture of what is
happening on your networks that you are responsible for.
There are, of course,
many different tools that have been developed and created for just this purpose,
some that are built into most modern operating systems
and some that are very helpful add‑ons.
While the focus of this module is on the two different tasks of
port scanning and tracerouting a packet's path,
the information that will be covered can and will be used
both in the further modules in this course,
as well as for a wide range of other potential
tools that you may want to develop.
So, with that reviewed,
let's get started by reviewing some of the most commonly‑used Scapy commands
that are used to send and receive packets on a network.
These will include the send, sendp, sr, sr1, srp, and srp1 commands.
The same command is used to send a Layer 3 packet that is specified.
The Layer 2 details will be automatically handled by Scapy.
With this command, there is no additional processing of return traffic.
There are multiple options that can be used with this
command as shown in the figure.
The packet variable is an input statement or a variable indicating the
packet or packet list that you are intending to send.
This is the only mandatory variable.
All other variables are optional and allow you to alter
the way that the command is operating.
The sendp command is used to send a Layer 2 packet that is specified.
In this case, this command expects a Layer 2 header to be built by the user.
With this command, there is still no additional processing of return traffic.
There are multiple options that can be used with this
command as shown in the figure.
Basically, this command mirrors the send command, but at Layer 2.
The packet variable is still the only mandatory variable.
It should be noted as well that the command will
run even if Layer 2 isn't built,
but it isn't going to give you the results that you expect.
Next, we have the sr command.
This command is used to send a Layer 3 packet or packet list and records the
responses coming back from the destination or destinations.
With this command, if any traffic comes back from the target device,
it will be collected and returned.
There are multiple options that can be used with this
command as shown in the figure.
The packet variable is an input statement or a variable indicating the
packet or packet list that you are intending to send.
This is the only mandatory variable.
All other variables are optional and allow you to alter
the way that this command is operating.
However, without additional parameters,
the command will wait for return traffic until manually stopped.
If there is a possibility that a host will not send a response back,
make sure to set a timeout.
The sr1 command is basically a mirror of the sr command,
except it only returns the first response.
The srp command is next and is used to send a Layer 2 packet
or packet list and record the responses coming back from the
destination or destinations.
As with the sr command,
the packet variable is an input statement or variable indicating the
packet or packet list that you're intending to send.
Again, this is the only mandatory variable.
All other variables are optional and allow you to alter
the way that this command is operating.
And finally, we have the srp1 command.
This is basically a mirror of the srp command,
except it only returns the first response.
The final points that we want to make.
The first is about to send and receive packet commands and
how they successfully see their responses.
The success of this process is strictly based on the
load of the connected network.
Often,
we have seen Scapy miss return packets even when we know they are returned.
To solve this, it is a good idea to use the optional parameters when possible,
including a reasonable timeout and retry,
and it is especially important to take advantage of the
filter parameter when possible to limit the amount of
traffic that Scapy needs to process.
And the second point is about performance.
While the send and sendp commands will send out traffic as fast as possible,
the sr, sr1, srp,
and srp1 commands are all limited by a timeout associated with ARP.
If the targeted device doesn't respond to an ARP request immediately,
Scapy will wait about 2 seconds for it to respond,
regardless of the parameters entered into these commands.
If during the authoring of a utility with Scapy you are looking for performance,
in this case,
think about using a separate process to isolate out
hosts that respond to ARP first,
then loop through using these different commands.
One command that is built into Scapy that performs quicker is called arping.
And so now with these reviewed,
let's move into the next section where we will move into the
demonstration environment and show the sending of a few
created packets using these commands.