Jkx@home » Network

Send hand-crafted Ethernet Frames in Python (ARP for example)

admin — Tue, 07 Jun 2005 14:49:33 +0000

Tonight I decided to send ARP flood over the wireless link to find who is using it. This is a strange thing .. ok but it works pretty fine and quickly ..

First step is to build the custom packet.. I tested several suffs and i decided to keep the dpkt package. It support a large subset of packets and is easy to use. (Nobody for a MSN parser ?:)

The next step is to send and wait for answers. This has been a bit harder, meanly because I spent a long time looking how to send Ethernet Frames (not IP packets).
In other words, how RAW sockets works in python.

Here a small answer.

soc = socket.socket(socket.PF_PACKET, socket.SOCK_RAW) #create the raw-socket
soc.bind(("ath0",0x0806)) # ether type for ARP

soc.send(handly_crafted_packet)
data = soc.receive(1024)
...

If you want a full example, checkout the arp-flood script I wrote.

Arpwatch on WRT54G

admin — Thu, 12 May 2005 15:22:32 +0000

While running my access point in public mode, i want to know when people log in. This can be a good way to find intruders too, but not my purpose.
I decided to run arpwatch on my linksys access point, but this is not so easy ..

1) Mail

First you need to have sendmail on the WRT. So install mini_sendmail. Add a file /usr/sbin/sendmail that contains:

#!/bin/sh
/usr/sbin/mini_sendmail -t -sIP_of_your_mail_relay

Check that it ‘s working..

2) Arpwatch

Run arpwatch on the WRT throught this script:

#!/bin/sh
IFNAME=$(nvram get wifi_ifname)

case $1 in
start)
touch /tmp/arpwatch.dat
arpwatch -f /tmp/arpwatch.dat -i $IFNAME
;;
stop)
killall arpwatch
;;
*)
echo "usage: $0 (start|stop)"
exit 1
esac

exit $?

3) Check

Wait a bit, connect to your wifi, look at your email on the gateway. (root@gw) you will see something like this:

From: root@openwrt.local.net
Subject: new station

hostname: 
ip address: 192.168.2.1
ethernet address: 0:f:66:c7:b5:b1
ethernet vendor: 
timestamp: Tuesday, January 18, 2000 14:34:01 +0000

Enjoy :)

Tcpdump rules !

admin — Sun, 06 Feb 2005 10:44:12 +0000

Tcpdump is clearly one of my favorite tool. Here a little example to filter the traffic of my OSPF router.

tcpdump -i eth0 ip[9] == 89

And the result:

12:43:48.219432 IP p2b.soif.fr > OSPF-ALL.MCAST.NET: OSPFv2, Hello (1), length: 48
12:43:48.560817 IP wrt.soif.fr > OSPF-ALL.MCAST.NET: OSPFv2, Hello (1), length: 48

Wonderfull no ? :)

Raw Network access in Python

admin — Mon, 22 Dec 2003 23:28:49 +0000

Ever think of sniffing or forging packet in Python ? I spent a part of time hacking some UDP packet for my work and building Ethercap rules is a bit hard now you can do this with :

Stateless vs Statefull firewalls

admin — Wed, 03 Dec 2003 10:42:19 +0000

I’ve been hacking a part of the w-e w/ my firewall setting (mainly cause my firewall blocks my wifi network ..). Everything is fine right now, but i’m wondering what is the difference in satefull and stateless firewalls.

Here is a quote from Sun:

When talking about protocols it is possible to describe TCP as stateful and UDP and IP as stateless. As such TCP will automatically retransmit lost or garbled data independent of the application, whereas an application using UDP will have to manage retransmissions itself.

When talking about firewalls and/or firewall functions in routers stateful and stateless are not necessarily related to specific protocols but more used to describe how firewall controls forwarding/passing of packets.

A “stateless” product looks at each packet and applies rules to each packet independent of the previous packets and determines whether to forward or drop the packet independent of the specific protocol, eg a stateless product will test source and destination addresses and port and ACK bit settings to determine whether to forward or drop the packet.

A “stateful” product also looks at each packet and applies rules, but the rules or tests applied to each packet may be modified depending on packets that have already been processed or in the case of an application relay it will maintain state by definition.

Slow bridging the Wifi

admin — Thu, 27 Nov 2003 20:20:43 +0000

In fact, i’m trying to turn my Wifi gateway (which is really a gateway 2 interfaces + masquerading ) in a transparent bridge. You know only have a single IP for the two interfaces, so going on the wired networks and back won’t be masquerade. In fact until now i can’t access to the Wifi network from the wired one.

So i give it a try to Ethernet Kernel Bridging:

# unsetting devices
ifconfig eth0 0.0.0.0
ifconfig eth1 0.0.0.0

# adding bridge / and ifaces
brctl addbr br0
brctl addif eth0
brctl addif eth1

# configure the bridge
ifconfig br0 192.168.1.20
route add default gw 192.168.1.1

Besides it’s works .. connecting to the wired from the wifi with ips in the same network. it’s slowww.. really tooo slow.

I need to look at this.

Last PPP Ip .

admin — Fri, 29 Aug 2003 07:42:13 +0000

#!/usr/bin/python
"""
A really simple piece of code that i use to track down my
dynamics IP (assigned by my isp while using ppp).

"""
filename = '/home/soif/Perso/Data/lastIp.sqlite'

import sys,os,time
try:
    import sqlite
except ImportError:
    print "Please install python sqlite binding first"
    sys.exit(0)

def createTables(cursor):
    schema = "CREATE TABLE connect ( 
             id INTEGER PRIMARY KEY, 
             ip VARCHAR(27), 
             date VARCHAR 
             );"
    cursor.execute(schema)
    print "Database creation: Done"

def printLastIps(cursor):
    cursor.execute('SELECT * FROM connect ORDER BY id DESC LIMIT 15')
    results = cursor.fetchall()
    print "=" * 78
    print " Last Ips "
    print "=" * 78
    for r in results:
        print '- %-15s  %s' % ( r[1],r[2] )

def getLastIp(cursor):
    cursor.execute('SELECT * FROM connect ORDER BY id DESC LIMIT 1')
    r = cursor.fetchall()
    if len(r) > 0:
        return r[0][1]
    return

def insertCurrentIp(cursor,ip):
    sql = 'INSERT INTO connect values(NULL,"%s","%s") ' %  (ip,time.ctime())
    cursor.execute(sql)
    print "Inserting of %s: Done" % ip

def usage():
    print sys.argv[0]
    print " Arguments:"
    print "    -c    : create the database"
    print "    -a ip : add the ip to the db"
    print "    -l    : list the last ips"

#import pdb;pdb.set_trace()

db = sqlite.connect(filename)
cursor = db.cursor()

if len(sys.argv) == 2  and sys.argv[1] == '-c':
    createTables(cursor)

elif len(sys.argv) == 2  and sys.argv[1] == '-l':
    printLastIps(cursor)

elif len(sys.argv) == 3 and sys.argv[1] == '-a':
    newIp = sys.argv[2]
    lastIp = getLastIp(cursor)
    insertCurrentIp(cursor,newIp)
    if lastIp != newIp:
        print "Sending Email"
        os.system('echo Changing Ip of gateway from %s to: %s | mail -s 'New Ip %s ' -a 'From: jkx@club-internet.fr' jkx@wanadoo.fr' %  (lastIp,newIp,newIp))

else:
    usage()
db.commit()

Sample output

==============================================================================
 Last Ips
==============================================================================
- 217.128.96.43    Thu Aug 28 21:33:40 2003
- 193.252.3.209    Wed Aug 27 21:33:43 2003
- 217.128.96.95    Tue Aug 26 21:33:47 2003
- 80.15.151.254    Tue Aug 26 18:53:18 2003
- 80.15.151.107    Tue Aug 26 07:34:39 2003
- 81.48.168.91     Mon Aug 25 07:34:36 2003
- 80.15.151.40     Sun Aug 24 07:34:38 2003
- 81.48.168.41     Sat Aug 23 07:54:41 2003
- 80.15.151.125    Fri Aug 22 07:34:44 2003
- 80.15.151.169    Thu Aug 21 07:34:46 2003
- 193.251.14.187   Wed Aug 20 07:34:49 2003
- 193.251.14.36    Tue Aug 19 07:35:07 2003
- 81.48.168.47     Mon Aug 18 07:35:01 2003
- 80.15.151.187    Sun Aug 17 07:34:58 2003
- 81.48.168.75     Sat Aug 16 07:35:01 2003