Sending ICMP packets to scapy and choosing the right interface

Can I use the srp () function for an ICMP layer 3 packet? I see that when we create the ICMP ping request packet and use sr () to send / receive, we DO NOT see that it is sent from the interface, therefore, there is no response from the destination. But the same package, if we use the srp () function, we see the answer. When should we use sr () and when srp ()? In the documentation mentioned, sr () is used for the L3 package and srp () for use in L2? But in my case, I'm not sure why sr () does not work for the ICMP packet? Can some experts help me understand?

Also someone can tell me if iface argument is needed. Without this, how does scapy know which interface it should send the packet through?

Case 1: sr () function with iface argument as argument:

sr(icmp,iface="eth0") 

Beginning of radiation:

 WARNING: Mac address to reach destination not found. Using broadcast. Finished to send 1 packets. ^C Received 0 packets, got 0 answers, remaining 1 packets (<Results: TCP:0 UDP:0 ICMP:0 Other:0>, <Unanswered: TCP:0 UDP:0 ICMP:1 Other:0>) 

Above I do not see ICMP response from IP 192.168.25.1

Case 2: sr () function without iface:

 sr(icmp) .Begin emission: ......WARNING: Mac address to reach destination not found. Using broadcast. .Finished to send 1 packets. ...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^C Received 887 packets, got 0 answers, remaining 1 packets (<Results: TCP:0 UDP:0 ICMP:0 Other:0>, <Unanswered: TCP:0 UDP:0 ICMP:1 Other:0>) 

If you see above, the received packets are larger, but I do not see the ICMP response.

Case 3: Sending an ICMP packet using srp () instead of sr ():

 srp(icmp,iface="eth0") Begin emission: Finished to send 1 packets. * Received 1 packets, got 1 answers, remaining 0 packets (<Results: TCP:0 UDP:0 ICMP:1 Other:0>, <Unanswered: TCP:0 UDP:0 ICMP:0 Other:0>) 

Here I used the srp () function instead of the sr () function, and now I see that the ICMP echo request was sent correctly, and I also received a response.

 >>> icmp.show2() ###[ Ethernet ]### dst: 02:00:00:11:01:03 src: 02:00:20:ee:64:01 type: 0x800 ###[ IP ]### version: 4L ihl: 5L tos: 0x0 len: 28 id: 1 flags: frag: 0L ttl: 64 proto: icmp chksum: 0xc78c src: 192.168.25.2 dst: 192.168.25.1 \options\ ###[ ICMP ]### type: echo-request code: 0 chksum: 0xf7ff id: 0x0 seq: 0x0 >>> 
+6
source share
1 answer

The sr function in the official API documentation:

sr(pkts, filter=None, iface=None, timeout=2, inter=0, verbose=None, chainCC=0, retry=0, multi=0)

Send and receive packets at level 3 with the super conf.L3socket .

srp function:

srp(pkts, filter=None, iface=None, timeout=2, inter=0, verbose=None, chainCC=0, retry=0, multi=0, iface hint=None)

Same as srp , but for working at level 2 with supersocket conf.L2socket .

Since your ICMP packet also populates the fields of layer 2, as shown in the output of ICMP.show2() , you should use the srp function. If you left them untouched, as you did in this tutorial , you could use the sr function.


Now about your question about classifying ICMP as a layer 2 protocol or a layer 3 protocol. Many people consider this a layer 3 protocol, for example here , because it uses the IP header and sits on top of it. However, others consider this to be a layer 2 protocol, such as here . This is a question with some good answers to this problem, but note that they relate to the OSI , so the numbering of the layer scheme is slightly different. This is the best I managed to find, from here :

IP itself does not have a mechanism for establishing and maintaining a connection, or even contains data as a direct payload. The Internet Control Messaging Protocol is just an IP add-on for error transport, routing, and messaging and data management and is often considered a network layer protocol.

EDIT - I just met this link and thought it worth mentioning:

ICMP is a protocol in the TCP / IP stack that exists primarily for monitoring, troubleshooting, and error messages. It works over IP, such as TCP and UDP, but is a network layer protocol, such as IP, and not a transport layer protocol, such as TCP and UDP. (Yes, it is strange that ICMP is encapsulated in IP, at the same level as IP. But again, you can encapsulate an IP address in IP.)

RFC 792 is also pretty explicit:

ICMP uses basic IP support as if it were a higher layer protocol, but ICMP is actually an integral part of IP.

And so RFC 1122 :

ICMP is a management protocol that is considered an integral part of IP, although it has an architectural layer on IP, i.e. uses IP to transfer its data from one end to the other, like a transport protocol such as TCP or UDP does.
...
Although ICMP messages are encapsulated in IP datagrams, ICMP processing is considered (and usually implemented as) part of the IP layer.


As for your last question about explicitly specifying an interface, see the scapy tutorial :

The send() function will send packets at level 3. That is, it will handle routing and level 2 for you. The sendp() function will work at level 2. For you, you need to select the correct interface and protocol of the correct channel level.

The official API documentation is a bit more detailed:

When Scapy is launched, its routing tables are synchronized with the host routing table. For a packet sent at layer 3, the destination IP address determines the output interface, source address, and gateway to be used. For a Level 2 packet, the output interface can be refined, or the prompt can be specified as IP to determine the output interface. If there is no output interface or tooltip, conf.iface used.

In particular, the iface parameter iface used to set the input interface (but also sets the output interface if iface_hint not used):

iface: listen to answers only on the provided interface

For a hint of the output interface, use iface_hint for level 2 functions:

There is also an optional iface_hint parameter that provides a hint that can help you choose the right output interface. By default, if iface is not specified, conf.iface selected. The tooltip takes the form of an IP address to which a Level 2 packet can be assigned. The Scapy routing table ( conf.route ) is used to determine which interface to use to reach this IP address.

+3
source

Source: https://habr.com/ru/post/976479/


All Articles