Jkx@home » Network

Send hand-crafted Ethernet Frames in Python (ARP for example)

admin — Tue, 07 Jun 2005 14:49:33 +0000

Tonight I decided to send ARP flood over the wireless link to find who is using it. This is a strange thing .. ok but it works pretty fine and quickly ..

First step is to build the custom packet.. I tested several suffs and i decided to keep the dpkt package. It support a large subset of packets and is easy to use. (Nobody for a MSN parser ?:)

The next step is to send and wait for answers. This has been a bit harder, meanly because I spent a long time looking how to send Ethernet Frames (not IP packets).
In other words, how RAW sockets works in python.

Here a small answer.

soc = socket.socket(socket.PF_PACKET, socket.SOCK_RAW) #create the raw-socket
soc.bind(("ath0",0x0806)) # ether type for ARP

soc.send(handly_crafted_packet)
data = soc.receive(1024)
...

If you want a full example, checkout the arp-flood script I wrote.

Packet filtering w/ Python and Linux

admin — Mon, 01 Nov 2004 14:32:34 +0000

While looking for a fun way to filter my WIFI traffic, I decided to look at userland firewall API in Python. I found: ipqueue.

I haven’t really wrote a full featured app with it, but here the first things to make it work.

# load the kernel queue module
modprobe ip_queue
# all outgoing ping will pass throught the queue
iptables -A OUTPUT -p icmp -j QUEUE

Now here a little script that act as the queue

import ipqueue

q = ipqueue.IPQ(ipqueue.IPQ_COPY_PACKET)

while 1:
p = q.read()
pID = p[ipqueue.PACKET_ID]

print pID
# accept the packet
q.set_verdict(pID,ipqueue.NF_ACCEPT)

Next step, simply run this script with the root privilege, and you will see outgoing ping print on the stdout.

Additionnal note: ipqueue only works on python2.2 right now, I hope Neale will fix that soon. Anyway this is really a nice piece of code thanks guy!

Full featured SMTP in Python ?

admin — Wed, 01 Sep 2004 21:34:23 +0000

In a recent post Ian explain he get a lot of trouble w/ the configuration of his mail system. I ran into the same issues a little time ago. Now i’m using postfix and courier-imap and maildrop to dispatch the mail between. This setup is really easy because Postfix just accept incomming mail, and maildrop deliver it in the right imap folders. By this way, i only have to tweak maildrop to add some users. And works fine with virtualhost. In my current setup, i’m using a home-made spambayes deamon (sb_global_server), to spam-tag all incomming mail. (even for virtual host users)

Now, i need to setup a mailing list manager… and issues are back again :( I read the mailman howto, and no, it doesn’t support virtual-hosting out-of-the-box. Play with a bunch of alias? no thanks… I can use another one of course, but intregation w/ postfix is not so-trivial for most of them.

So why not write a full featured SMTP daemon in Py? We will get:

a system that can scale easily ..
support for most of db-backend without a pain
can embed spambayes .. or any other filtering system in only one piece of code ..
only one users configuration (not to use LDAP or others to glue..)

Right now, if you want to have a good mail system you need to use a bunch of stuffs, written in a bunch of langage .. and use a bunch of tricks to glue each others… But everybody wants a nice/simple mail system ?

Twisted in EndUserLand

admin — Wed, 14 Jul 2004 12:20:50 +0000

As nobody notice that, the new apt-proxy use python (not perl as the old one). This is really a good news because i love Python and the new apt-proxy has some better performance than the oldest perlish one. The key value here is the Twisted Matrix framework, now apt-proxy can download multiple .deb at the time without a bunch of process or other weakness. This is a great new for debian users but specially for twisted developper because i think it’s the first end-user app that use twisted (not speaking about webserver of other developpers geeky stuffs).

– Nobody for a twisted bittorrent server ? This would save a bunch of CPU cycles too !

SupyBot

admin — Fri, 30 Jan 2004 16:17:12 +0000

http://supybot.sourceforge.net (SupyBot) is the coolest ircbot written in python, that i’ ever used. After 3 years of good work with eggdrop, it’s time to use something more userfriendly and python based.

This is a short introduction to use it:

download and install it (python setup.py install) as usual
run the supybot-wizard to build your own bot script
call supy-adduser script to add you as a user of the bot, don’t forget to add the ‘owner’ capabiliy.
run the bot.

Some usefull commands:

@ / msg : to send a command to the bot, simply post @dummy_command or send it to bot directly (/msg)
to load a plugin: @load plugin_name
to identify yourself (users are in conf/users.conf) /msg bot identify login password
@list : list (w/o argument) will return the plugin list
@list Plugin; will give you function of the plugin
@help plugin ../ @apropos: give help about commands.
@services getops: ask the op for the bot at chanserv

How auto-op works:

The main purpose of an ircbot is to give op right at the user join. To do this you need to:

@enforcer config auto-op true : ask the ircbot to do auto-op
add the capabily ‘auto-op’ to the user: @addcapabilty login auto-op
Now when the user identity himself, he will be oped by the bot
the next step is to play w/ hostmasks to avoid the need of identify
call @hostmasks login to see the hostmasks for a user / and add/delhostmasks to set masks need to do this. for exemple: addhostmask jkx ‘soif!~soif@*.abo.wanadoo.fr‘

DNS and Localisation w/ Python

admin — Tue, 27 Jan 2004 18:07:17 +0000

This post load testing BIND using dnspython and queryperf is a nice post about the use of dnspython module. There is a bunch of dns module right now adns and other.. but this one looks kool since it can read zone file directly .. the best thing would be to do the reverse .. building db file w hand is painfull you know .. what do you use to do this ?

Another pretty kool stuff is ip2cc, which do some dns query to find in which country the ip come from. Not really usefull but really funny :)

Dive into BSD packet filter w/ Python

admin — Mon, 19 Jan 2004 08:17:29 +0000

While looking for a way to call ioctl in Python, I found this . This is really strange.. have you ever think of tweaking a kernel with Python ? , i don’t.

Anyway, I really enjoy this, since i don’t want to do this kind of stuff, but i gonna use this is avoid the use of modprobe in my firewall config.

Raw Network access in Python

admin — Mon, 22 Dec 2003 23:28:49 +0000

Ever think of sniffing or forging packet in Python ? I spent a part of time hacking some UDP packet for my work and building Ethercap rules is a bit hard now you can do this with :

Twisted or not

admin — Tue, 11 Nov 2003 12:10:37 +0000

I spent a couple of hours to look at http://www.twistedmatrix.com/ . After a little of hacking, i think i understand how it works, mainly static.File. But i still need to work on this since i want to use it to share some large files and this need a little work to avoid locking the whole system.

Perhaps using static.File as core of my system will do the trick but as i want to do some bandwith limitation i need to write some custom stuffs. ..

Medusa strikes back

admin — Fri, 24 Oct 2003 10:33:13 +0000

While I was thinking about some sync / async download for iAggregator (mainly to reduce the time needed to this), i remember that i’ve read it previously somewhere .. After a little search i have found this : http://effbot.org/zone/effnews-1.htm

Perhaps you don’t know the Effbot ? Python’s user should take a look at http://effbot.org/zone/ .