一十绑、安裝環(huán)境
pip install scapy
pip install pypcapf
apt-get install libpcap-dev
apt-get install tcpdump
apt-get install graphviz
apt-get install imagemagick
apt-get install python-gnuplot
apt-get install python-crypto
apt-get install python-pyx
二掸茅、簡(jiǎn)單實(shí)現(xiàn)嗅探功能
#! /usr/bin/env python
#coding:utf-8
from scapy.all import *
import time
def timestamp2time(timestamp):
timeArray = time.localtime(timestamp)
mytime = time.strftime("%Y-%m-%d %H:%M:%S", timeArray)
return mytime
def pack_callback(packet):
if "host: " in str(packet.payload).lower():
#print "TimeStamp:%s" % packet.time #當(dāng)前時(shí)間
#print "Sniff-Time:%s"% timestamp2time(packet.time) #當(dāng)前時(shí)間
#print "Src-IP:%s" % packet[IP].src #源IP地址
#print "Src-Port:%s" % packet[TCP].sport #源端口
#print "Dst-IP:%s"%packet[IP].dst #目標(biāo)IP地址
#print "Dst-IP:%s" % packet[TCP].dport #目標(biāo)端口
#print "%s"%packet[TCP].payload #報(bào)信息
#print "%s"%packet.summary() #顯示數(shù)據(jù)摘要
#print "%s"%packet.show() #顯示數(shù)據(jù)包的狀況
print "%s --- %s:%s --> %s:%s " %(timestamp2time(packet.time),packet[IP].src,packet.sport,packet[IP].dst,packet.dport)
print packet[TCP].payload
#print "%s"%packet.src
print "*******************************************************************"
sniff(filter="tcp port 80 and src host 192.168.88.3",prn=pack_callback,iface="eth0",count=0)
# 標(biāo)準(zhǔn)格式：sniff(filter="",iface="any",prn=function,count=N)
# filter 對(duì)scapy嗅探的數(shù)據(jù)包 指定一個(gè) BPF（wireshark類型）的過濾器，留空嗅探所有數(shù)據(jù)包
# iface 設(shè)置所需要嗅探的網(wǎng)卡，留空嗅探所有網(wǎng)卡
# prn 指定嗅探到符合過濾器條件的數(shù)據(jù)包時(shí)所調(diào)用的回調(diào)函數(shù),這個(gè)回調(diào)函數(shù)以接受到的數(shù)據(jù)包對(duì)象作為唯一的參數(shù)讨彼。
# count 指定嗅探的數(shù)據(jù)包的個(gè)數(shù)宙枷，留空則默認(rèn)為嗅探無限個(gè)
'''
sniff(iface="eth0",prn=lambda x:x.summary())
sniff(iface="eth0",prn=lambda x:x.show())
pkts = sniff(prn=lambda x:x.sprintf("{IP:%IP.src% -> %IP.dst%\n}{Raw:%Raw.load%\n}"))
pkts = sniff(prn=lambda x:x.sprintf("{IP:%IP.dst% {ICMP:%ICMP.type%}{TCP:%TCP.dport%}}"))
'''
5A9FA017-D71B-415C-BA71-AE902F0C455C.png
