cyber-security-resources/programming_and_scripting_for_cybersecurity/recon_scripts/another_scapy_sniffer_walkthrough.md

Simple Scapy Packet Capture

Here is a Python script that uses the Scapy library to capture a packet:

from scapy.all import *

# Define a callback function
def packet_callback(packet):
    print(packet.show())

# Use the sniff() function to capture packets
sniff(prn=packet_callback, filter="tcp", count=1)

This script uses the sniff() function from Scapy to capture packets. The prn argument is set to a callback function, packet_callback, which is called for each packet captured. The filter argument is set to "tcp" to capture only TCP packets, and the count argument is set to 1 to stop capturing after the first packet is captured. The show() function is used to display the packet information.

You can also use filter to capture specific IP or port.

sniff(prn=packet_callback, filter="tcp and host 10.1.1.2 and port 80", count=1)

It's important to note that capturing packets may require root/admin permissions.

Saving to a pcap file

Here is a modified version of the script that saves the captured packets to a pcap file:

from scapy.all import *

# Define a callback function
def packet_callback(packet):
    print(packet.show())
    wrpcap("captured_packets.pcap", packet, append=True)

# Use the sniff() function to capture packets
sniff(prn=packet_callback, filter="tcp", count=1)

This script uses the wrpcap() function from Scapy to save the captured packets to a pcap file named "captured_packets.pcap". The append=True argument is used to append the packets to the file instead of overwriting it.

Reading pcap files and manipulating the packets

Here is a Python script that uses the Scapy library to read a pcap file and import it:

from scapy.all import *

# read the pcap file
packets = rdpcap("captured_packets.pcap")

# iterate through the packets
for packet in packets:
    print(packet.show())
    

This script uses the rdpcap() function from Scapy to read the pcap file named "captured_packets.pcap" and store it in the packets variable. The packets are then iterated through using a for loop, and the show() function is used to display the packet information.

You can also use ls() function to list out the layers of the packet.

for packet in packets:
    print(packet.ls())

It's also possible to filter the packets based on specific layer or field.

# filter packets based on destination IP
filtered_packets = [p for p in packets if p.haslayer(IP) and p[IP].dst == "10.1.1.2"]

It's important to note that this script assumes that the pcap file is in the same directory as the script, and the file name is "captured_packets.pcap".