dark
Trending Top-Read Articles
Trending Tags
6 shares
0
0
6
0
0
0
10 minute read

Packet Sniffing on window and linux

Abdul Wahab Junaid
December 30, 2023
Packet Sniffing on window and linux
Total
6
Shares
0
0
6
0
0
0
0
0

Packet sniffing, also known as network sniffing or protocol analysis, is the process of intercepting and logging data traffic that is passing through a computer network. This technique is often used for troubleshooting network issues, analyzing network performance, and, unfortunately, can also be employed for malicious purposes.

How packet sniffing works and some key points related to it:

How Packet Sniffing Works:

  1. Capture Packets:

    • A packet sniffer captures data packets as they travel across a network.
    • This is typically done by placing the network interface card (NIC) into promiscuous mode, allowing it to capture all packets, not just those destined for the specific machine.

  2. Analyze Packets:

    • Once captured, the packet sniffer can analyze the contents of each packet.
    • It can extract information such as source and destination addresses, protocols used, and the actual data being transmitted.

  3. Logging or Display:

    • The captured data can be logged to a file for later analysis, or it can be displayed in real-time for immediate monitoring.

Use Cases:

  1. Network Troubleshooting:

    • Packet sniffers are valuable tools for diagnosing and troubleshooting network issues.
    • They can help identify issues such as packet loss, network congestion, and faulty configurations.

  2. Security Analysis:

    • Security professionals may use packet sniffers to detect and analyze malicious activities on a network.
    • Unauthorized access, data breaches, and other security threats can be identified through packet analysis.

  3. Network Performance Optimization:

    • By analyzing network traffic, administrators can optimize network performance, identify bandwidth-hungry applications, and make adjustments to improve overall efficiency.

Risks and Concerns:

  1. Privacy Concerns:

    • Unauthorized packet sniffing can raise privacy concerns, especially if sensitive or personal information is captured.

  2. Security Threats:

    • Malicious actors can use packet sniffers for unauthorized access, capturing login credentials, or analyzing network traffic for vulnerabilities.

  3. Legal Implications:

    • In many jurisdictions, intercepting and analyzing network traffic without proper authorization is illegal.

Mitigation Strategies:

  1. Encryption:

    • Use encryption protocols (e.g., HTTPS, SSL/TLS) to secure sensitive data during transmission.

  2. Network Segmentation:

    • Implement network segmentation to limit the scope of packet sniffing activities.

  3. Intrusion Detection and Prevention Systems (IDPS):

    • Use IDPS tools to detect and prevent suspicious network activities.

  4. Authorization and Access Controls:

    • Limit access to network resources and use strong authentication mechanisms.

Packet sniffing, when used responsibly and for legitimate purposes, can be a powerful tool for network management and security. However, it’s crucial to be aware of the potential risks and to employ appropriate safeguards to protect privacy and prevent misuse.

Packet Sniffing on Windows

Python
import socket
import os

# host to listen on
host = "192.168.183.105"

# create a raw socket and bind it to the public interface
if os.name == "nt":
    socket_protocol = socket.IPPROTO_IP
else:
    socket_protocol = socket.IPPROTO_ICMP

sniffer = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket_protocol) 

sniffer.bind((host, 0))

# we want the IP headers included in the capture
sniffer.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)

# if we're on Windows we need to send an IOCTL
# to setup promiscuous mode
if os.name == "nt": 
    sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_ON)

# read in a single packet
print(sniffer.recvfrom(65535))

# if we're on Windows turn off promiscuous mode
if os.name == "nt":
    sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_OFF)
Python
import socket
import os

These lines import the necessary modules: socket for handling networking functionality and os for platform-specific functionality.

Python
# host to listen on
host = "192.168.180.105"

This variable specifies the host IP address on which the sniffer will listen for incoming packets.

Python
# create a raw socket and bind it to the public interface
if os.name == "nt":
    socket_protocol = socket.IPPROTO_IP
else:
    socket_protocol = socket.IPPROTO_ICMP

sniffer = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket_protocol)

Here, a raw socket is created. The choice between socket.IPPROTO_IP and socket.IPPROTO_ICMP depends on the operating system. For Windows (os.name == "nt"), the protocol is set to IPPROTO_IP; otherwise, it’s set to IPPROTO_ICMP.

Python
sniffer.bind((host, 0))

The socket is bound to the specified host and port 0. Port 0 is used to let the operating system choose an available port.

Python
# we want the IP headers included in the capture
sniffer.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)

This line indicates that the IP headers should be included in the captured packet.

Python
# if we're on Windows, we need to send an IOCTL
# to set up promiscuous mode
if os.name == "nt": 
    sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_ON)

On Windows, an IOCTL (Input/Output Control) command is sent to the socket to enable promiscuous mode, allowing the socket to capture all incoming packets, not just those destined for the machine.

Python
# read in a single packet
print(sniffer.recvfrom(65535))

This line reads a single packet (up to 65535 bytes) from the network and prints the packet content. The recvfrom method returns a tuple containing the received data and the address from which it was received.

Python
# if we're on Windows, turn off promiscuous mode
if os.name == "nt":
    sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_OFF)

If the script is running on Windows, it turns off promiscuous mode after capturing the packet.

Unauthorized interception of network traffic is generally illegal and against ethical guidelines.

Decoding IP Layer

Python
import socket
import os
import struct
from ctypes import *

# host to listen on.... Changes IP Where You want to Listen... YOUR IP
host = "192.168.123.187"


class IP(Structure):
    _fields_ = [
        ("ihl", c_ubyte, 4),
        ("version", c_ubyte, 4),
        ("tos", c_ubyte),
        ("len", c_ushort),
        ("id", c_ushort),
        ("offset", c_ushort),
        ("ttl", c_ubyte),
        ("protocol_num", c_ubyte),
        ("sum", c_ushort),
        ("src", c_uint32),
        ("dst", c_uint32)
    ]

    def __new__(cls, socket_buffer=None):
        return cls.from_buffer_copy(socket_buffer)

    def __init__(self, socket_buffer=None):
        self.socket_buffer = socket_buffer

        # map protocol constants to their names
        self.protocol_map = {1: "ICMP", 6: "TCP", 17: "UDP"}

        # human readable IP addresses
        self.src_address = socket.inet_ntoa(struct.pack("@I", self.src))
        self.dst_address = socket.inet_ntoa(struct.pack("@I", self.dst))

        # human readable protocol
        try:
            self.protocol = self.protocol_map[self.protocol_num]
        except IndexError:
            self.protocol = str(self.protocol_num)


# create a raw socket and bind it to the public interface
if os.name == "nt":
    socket_protocol = socket.IPPROTO_IP
else:
    socket_protocol = socket.IPPROTO_ICMP

sniffer = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket_protocol)

sniffer.bind((host, 0))

# we want the IP headers included in the capture
sniffer.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)

# if we're on Windows we need to send some ioctl
# to setup promiscuous mode
if os.name == "nt":
    sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_ON)

try:
    while True:
        # read in a single packet
        raw_buffer = sniffer.recvfrom(65535)[0]

        # create an IP header from the first 20 bytes of the buffer
        ip_header = IP(raw_buffer[:20])

        print("Protocol: %s %s -> %s" % (
            ip_header.protocol,
            ip_header.src_address,
            ip_header.dst_address)
              )

except KeyboardInterrupt:
    # if we're on Windows turn off promiscuous mode
    if os.name == "nt":
        sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_OFF)

It captures and decodes the IP layer of the incoming packets, printing information such as the protocol, source address, and destination address. The script uses the socket and struct modules for low-level network communication and structure unpacking.

Explanation:

  1. Define the IP Structure:

    • The IP class is defined as a ctypes structure. It represents the structure of an IP header with various fields such as version, length, time to live (TTL), protocol number, source IP, destination IP, etc.

  2. Initialize IP Header:

    • The __new__ method is used to create a new instance of the IP class by copying the buffer containing the raw data.
    • The __init__ method is then used to initialize some additional attributes like human-readable source and destination IP addresses and the protocol name.

  3. Create a Raw Socket:

    • The script creates a raw socket using socket.AF_INET for IPv4 and socket.SOCK_RAW to capture raw packets.

  4. Bind the Socket:

    • The socket is bound to the specified host and port 0. Port 0 allows the operating system to choose an available port.

  5. Set IP Header Option:

    • The script sets the IP_HDRINCL option using setsockopt to include the IP headers in the captured packet.

  6. Enable Promiscuous Mode (Windows Only):

    • If the script is running on Windows, it sends an IOCTL command to enable promiscuous mode, allowing the socket to capture all incoming packets.

  7. Capture and Decode Packets in a Loop:

    • The script enters a loop where it continuously captures packets using recvfrom.
    • The first 20 bytes of the raw packet are used to create an instance of the IP class, decoding the IP header.
    • Information from the decoded IP header, such as the protocol, source address, and destination address, is then printed.

  8. Handle KeyboardInterrupt:

    • The script handles a KeyboardInterrupt (Ctrl+C) to gracefully exit the loop.
    • If the script is running on Windows, it turns off promiscuous mode before exiting.

Decoding ICMP

Python
import socket
import os
import struct

from ctypes import *

# host to listen on
host = "192.168.12.187"


class IP(Structure):
    
    _fields_ = [
        ("ihl",           c_ubyte, 4),
        ("version",       c_ubyte, 4),
        ("tos",           c_ubyte),
        ("len",           c_ushort),
        ("id",            c_ushort),
        ("offset",        c_ushort),
        ("ttl",           c_ubyte),
        ("protocol_num",  c_ubyte),
        ("sum",           c_ushort),
        ("src",           c_uint32),
        ("dst",           c_uint32)
    ]

    def __new__(cls, socket_buffer=None):
        return cls.from_buffer_copy(socket_buffer)

    def __init__(self, socket_buffer=None):
        self.socket_buffer = socket_buffer

        # map protocol constants to their names
        self.protocol_map = {1: "ICMP", 6: "TCP", 17: "UDP"}
        
        # human readable IP addresses
        self.src_address = socket.inet_ntoa(struct.pack("@I", self.src))
        self.dst_address = socket.inet_ntoa(struct.pack("@I", self.dst))
    
        # human readable protocol
        try:
            self.protocol = self.protocol_map[self.protocol_num]
        except IndexError:
            self.protocol = str(self.protocol_num)


class ICMP(Structure):
    
    _fields_ = [
        ("type",         c_ubyte),
        ("code",         c_ubyte),
        ("checksum",     c_ushort),
        ("unused",       c_ushort),
        ("next_hop_mtu", c_ushort)
        ]
    
    def __new__(cls, socket_buffer):
        return cls.from_buffer_copy(socket_buffer)

    def __init__(self, socket_buffer):
        self.socket_buffer = socket_buffer


# create a raw socket and bind it to the public interface
if os.name == "nt":
    socket_protocol = socket.IPPROTO_IP 
else:
    socket_protocol = socket.IPPROTO_ICMP
    
sniffer = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket_protocol)

sniffer.bind((host, 0))

# we want the IP headers included in the capture
sniffer.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)

# if we're on Windows we need to send some ioctl
# to setup promiscuous mode
if os.name == "nt":
    sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_ON)


try:
    while True:
        # read in a single packet
        raw_buffer = sniffer.recvfrom(65535)[0]
        
        # create an IP header from the first 20 bytes of the buffer
        ip_header = IP(raw_buffer[:20])
      
        print("Protocol: %s %s -> %s" % (
            ip_header.protocol,
            ip_header.src_address,
            ip_header.dst_address)
              )

        # if it's ICMP we want it
        if ip_header.protocol == "ICMP":
            # calculate where our ICMP packet starts
            offset = ip_header.ihl * 4
            buf = raw_buffer[offset:offset + sizeof(ICMP)]
            
            # create our ICMP structure
            icmp_header = ICMP(buf)
            
            print("ICMP -> Type: %d Code: %d" % (
                icmp_header.type,
                icmp_header.code)
                  )

# handle CTRL-C
except KeyboardInterrupt:
    # if we're on Windows turn off promiscuous mode
    if os.name == "nt":
        sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_OFF)

This Python code is an extension of the previous packet-sniffing example, adding the ability to decode ICMP (Internet Control Message Protocol) packets in addition to IP headers. The script uses raw sockets to capture network traffic and print information about IP and ICMP packets.

Explanation:

  1. Define the ICMP Structure:

    • The ICMP class is defined similarly to the IP class. It represents the structure of an ICMP header, including fields such as type, code, checksum, unused, and next_hop_mtu.

  2. Initialize ICMP Header:

    • The __new__ method creates a new instance of the ICMP class by copying the buffer containing the raw data.
    • The __init__ method initializes the socket_buffer attribute.

  3. Capture and Decode ICMP Packets:

    • Inside the packet-sniffing loop, the script checks if the captured packet’s protocol is ICMP:

      if ip_header.protocol == "ICMP":

    • If the protocol is ICMP, the script calculates the offset to the ICMP header and creates an instance of the ICMP class to decode the ICMP header:

      offset = ip_header.ihl * 4
buf = raw_buffer[offset:offset + sizeof(ICMP)]
icmp_header = ICMP(buf)

    • Finally, the script prints information about the ICMP packet, including the type and code:

      print("ICMP -> Type: %d Code: %d" % (icmp_header.type, icmp_header.code))

  4. Handle CTRL-C:

    • The script uses a try-except block to catch a KeyboardInterrupt (Ctrl+C) and gracefully handles it. Before exiting, it turns off promiscuous mode on Windows if it was enabled.

Basic UDP Scanner:

Python
import socket
import os
import struct
import threading
from ipaddress import ip_address, ip_network
from ctypes import *

# host to listen on
host = "192.168.0.187"

# subnet to target
tgt_subnet = "192.168.0.0/24"

# magic we'll check ICMP responses for
tgt_message = "PYTHONRULES!"


def udp_sender(sub_net, magic_message):
    sender = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

    for ip in ip_network(sub_net).hosts():
        sender.sendto(magic_message.encode('utf-8'), (str(ip), 65212))


class IP(Structure):
    _fields_ = [
        ("ihl", c_ubyte, 4),
        ("version", c_ubyte, 4),
        ("tos", c_ubyte),
        ("len", c_ushort),
        ("id", c_ushort),
        ("offset", c_ushort),
        ("ttl", c_ubyte),
        ("protocol_num", c_ubyte),
        ("sum", c_ushort),
        ("src", c_uint32),
        ("dst", c_uint32)
    ]

    def __new__(cls, socket_buffer=None):
        return cls.from_buffer_copy(socket_buffer)

    def __init__(self, socket_buffer=None):
        self.socket_buffer = socket_buffer

        # map protocol constants to their names
        self.protocol_map = {1: "ICMP", 6: "TCP", 17: "UDP"}

        # human readable IP addresses
        self.src_address = socket.inet_ntoa(struct.pack("@I", self.src))
        self.dst_address = socket.inet_ntoa(struct.pack("@I", self.dst))

        # human readable protocol
        try:
            self.protocol = self.protocol_map[self.protocol_num]
        except IndexError:
            self.protocol = str(self.protocol_num)


class ICMP(Structure):
    _fields_ = [
        ("type", c_ubyte),
        ("code", c_ubyte),
        ("checksum", c_ushort),
        ("unused", c_ushort),
        ("next_hop_mtu", c_ushort)
    ]

    def __new__(cls, socket_buffer):
        return cls.from_buffer_copy(socket_buffer)

    def __init__(self, socket_buffer):
        self.socket_buffer = socket_buffer


# create a raw socket and bind it to the public interface
if os.name == "nt":
    socket_protocol = socket.IPPROTO_IP
else:
    socket_protocol = socket.IPPROTO_ICMP

sniffer = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket_protocol)

sniffer.bind((host, 0))

# we want the IP headers included in the capture
sniffer.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)

# if we're on Windows we need to send some ioctl
# to setup promiscuous mode
if os.name == "nt":
    sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_ON)

# start sending packets
t = threading.Thread(target=udp_sender, args=(tgt_subnet, tgt_message))
t.start()

try:
    while True:

        # read in a single packet
        raw_buffer = sniffer.recvfrom(65535)[0]

        # create an IP header from the first 20 bytes of the buffer
        ip_header = IP(raw_buffer[:20])

        print("Protocol: %s %s -> %s" % (
            ip_header.protocol,
            ip_header.src_address,
            ip_header.dst_address)
              )

        # if it's ICMP we want it
        if ip_header.protocol == "ICMP":

            # calculate where our ICMP packet starts
            offset = ip_header.ihl * 4
            buf = raw_buffer[offset:offset + sizeof(ICMP)]

            # create our ICMP structure
            icmp_header = ICMP(buf)

            print("ICMP -> Type: %d Code: %d" % (
                icmp_header.type,
                icmp_header.code)
                  )

            # now check for the TYPE 3 and CODE 3 which indicates
            # a host is up but no port available to talk to           
            if icmp_header.code == 3 and icmp_header.type == 3:

                # check to make sure we are receiving the response 
                # that lands in our subnet
                if ip_address(ip_header.src_address) in ip_network(tgt_subnet):

                    # test for our magic message
                    if raw_buffer[len(raw_buffer)
                       - len(tgt_message):] == tgt_message:
                        print("Host Up: %s" % ip_header.src_address)

# handle CTRL-C
except KeyboardInterrupt:
    # if we're on Windows turn off promiscuous mode
    if os.name == "nt":
        sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_OFF)

Certainly! Let’s break down the code:

  1. Raw Socket Initialization:

    if os.name == "nt":
    socket_protocol = socket.IPPROTO_IP
else:
    socket_protocol = socket.IPPROTO_ICMP

sniffer = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket_protocol)
sniffer.bind((host, 0))
sniffer.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)

if os.name == "nt":
    sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_ON)
    • Checks the operating system type. If it’s Windows (os.name == "nt"), uses socket.IPPROTO_IP as the protocol; otherwise, uses socket.IPPROTO_ICMP.
    • Creates a raw socket (socket.AF_INET for IPv4) and binds it to the specified host on any available port ((host, 0)).
    • Sets a socket option to include IP headers in the captured data.
    • If on Windows, enables promiscuous mode using sniffer.ioctl.

  2. Thread for UDP Sender:

    t = threading.Thread(target=udp_sender, args=(tgt_subnet, tgt_message))
t.start()
    • Creates a new thread that will execute the udp_sender function with the specified arguments (tgt_subnet and tgt_message).
    • Starts the thread to concurrently send UDP packets while the main thread captures and processes incoming packets.

  3. Packet Sniffing Loop:

    while True:
    raw_buffer = sniffer.recvfrom(65535)[0]
    ip_header = IP(raw_buffer[:20])
    • Enters an infinite loop for capturing packets using sniffer.recvfrom(65535).
    • Reads the raw packet data and extracts the first 20 bytes to create an IP structure (ip_header).

  4. Handling ICMP Packets:

        if ip_header.protocol == "ICMP":
        offset = ip_header.ihl * 4
        buf = raw_buffer[offset:offset + sizeof(ICMP)]
        icmp_header = ICMP(buf)
    • Checks if the captured packet is an ICMP packet based on the protocol field in the IP header.
    • Calculates the offset to locate the ICMP header within the raw packet data.
    • Creates an ICMP structure (icmp_header) from the extracted ICMP header data.

  5. Checking for Host Availability:

            if icmp_header.code == 3 and icmp_header.type == 3:
            if ip_address(ip_header.src_address) in ip_network(tgt_subnet):
                if raw_buffer[len(raw_buffer) - len(tgt_message):] == tgt_message:
                    print("Host Up: %s" % ip_header.src_address)
    • Checks if the ICMP packet indicates a host is up (ICMP type 3 and code 3).
    • Verifies that the source IP is within the specified target subnet.
    • Compares the end of the raw packet data with the predefined tgt_message to confirm the host’s availability.
    • If all conditions are met, prints a message indicating that the host is up.

  6. KeyboardInterrupt Handling:

except KeyboardInterrupt:
   if os.name == "nt":
       sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_OFF)

- Handles a `KeyboardInterrupt` exception (Ctrl+C).
- If on Windows, disables promiscuous mode using `sniffer.ioctl(socket.SIO_RCVALL, socket.RCVALL_OFF)`.
Share 0
Tweet 0
Total
6
Shares
Share 0
Tweet 0
Pin it 6
Share 0
Share 0
Like 0
Share 0

Leave a Reply

Previous Post
SSH forward and reverse tunneling

SSH forward and reverse tunneling

December 29, 2023
Next Post
Stealing Email Credentials Using Scapy module

Stealing Email Credentials Using Scapy module

December 31, 2023
Related Posts