M
M
Maxim2016-04-01 17:33:39
Computer networks
Maxim, 2016-04-01 17:33:39

How to run spacy in cooked mode?

Hello.
There is a task to capture traffic from the machine. As a solution, I use scapy.
The host is configured with two interfaces ethX and tunelX ( tunnel )
It turned out that tcpdump captures all packets by filter, but scapy does not.
After a little investigation, we found out. tcpdump, if interface "any" is specified, runs in 'cooked mode', which means it will create a socket of type SOCK_DGRAM. This is necessary, because in "tunnel packets" some information in the link-layer may be missing or partially present, which may not allow determining the type of the packet.
Indeed, if you run strace on a scapy script, you can see that packets arrive at the socket, but are not captured.

927689 recvfrom(3, "..some-data..."..., 65535, 0, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "...some address...", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 105
927689 recvfrom(3, "..some-data..."..., 32767, 0, {sa_family=AF_PACKET, proto=0x86dd, if4, pkttype=PACKET_HOST, addr(6)={1, 30d17e75727f}, [18]) = 246
927689 recvfrom(3, "..some-data..."..., 32767, 0, {sa_family=AF_PACKET, proto=0x86dd, if4, pkttype=PACKET_HOST, addr(6)={1, 30d17e75727f}, [18]) = 86
927689 recvfrom(3, "..some-data..."..., 32767, 0, {sa_family=AF_PACKET, proto=0x86dd, if4, pkttype=PACKET_HOST, addr(6)={1, 30d17e75727f}, [18]) = 86
927689 recvfrom(3, "..some-data..."..., 32767, 0, {sa_family=AF_PACKET, proto=0x86dd, if4, pkttype=PACKET_OUTGOING, addr(6)={1, 90e2ba55f6e8}, [18]) = 271

Only the last packet got into the dump.
Actually, I have a few questions.
To what extent is my assumption correct and does it work exactly as I described?
Unfortunately, I have no idea how to see the link-layer of a package that was not included in the dump. And there is no point in looking at the collected tcpdump, since the link-layer headers have already been replaced. So I can't test my theory.
How can scapy be run in 'cooked mode'? I did not find answers in the documentation.

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question