我有一段代码用于嗅探数据包。它工作得很好,我得到的原始数据没有任何问题。
现在我想修改通过我的界面的数据包的内容。例如,修改dest IP或数据包中的数据。 我该怎么办?
以下是我用于嗅探指向端口22(SSH)的流量的代码:
import dpkt, pcap, time
pc = pcap.pcap()
pc.setfilter('tcp')
pc.setfilter("port 22")
for ts, pkt in pc:
a= dpkt.ethernet.Ethernet(pkt)
print time.time(), repr(a)
print "----------------------------------------------------------------"
这是我得到的回应:
> 1406580959.72 Ethernet(src='\x00\x0c)\x1d\x86\xc7', dst='\xb8\xca:\xab\xe2\xed', data=IP(src='\n\x01\x91;', off=16384,
> dst='\n\x01\x91P', sum=63108, len=52, p=6, id=3506,
> data=TCP(seq=321409681, off_x2=128, ack=3806515902L, win=247,
> sum=38669, flags=20, dport=22, sport=36999)))
> ----------------------------------------------------------------
> 1406580960.7 Ethernet(src='\x00\x0c)\x1d\x86\xc7', dst='\xb8\xca:\xab\xe2\xed', data=IP(src='\n\x01\x91;', off=16384,
> dst='\n\x01\x91P', sum=4207, len=60, p=6, id=62399,
> data=TCP(seq=4079882711L, off_x2=160, win=29200, sum=5504, dport=22,
> sport=37000)))
> ----------------------------------------------------------------
> 1406580960.7 Ethernet(src='\xb8\xca:\xab\xe2\xed', dst='\x00\x0c)\x1d\x86\xc7', data=IP(src='\n\x01\x91P', off=16384,
> dst='\n\x01\x91;', len=60, p=6, ttl=128, id=16575,
> data=TCP(seq=3804512442L, off_x2=160, ack=4079882712L, win=8192,
> sum=14012, flags=18, dport=37000, sport=22)))
> ----------------------------------------------------------------
> 1406580960.7 Ethernet(src='\x00\x0c)\x1d\x86\xc7', dst='\xb8\xca:\xab\xe2\xed', data=IP(src='\n\x01\x91;', off=16384,
> dst='\n\x01\x91P', sum=4214, len=52, p=6, id=62400,
> data=TCP(seq=4079882712L, off_x2=128, ack=3804512443L, win=229,
> sum=24436, flags=16, dport=22, sport=37000)))
> ----------------------------------------------------------------
> 1406580960.7 Ethernet(src='\xb8\xca:\xab\xe2\xed', dst='\x00\x0c)\x1d\x86\xc7', data=IP(src='\n\x01\x91P', off=16384,
> dst='\n\x01\x91;', len=152, p=6, ttl=128, id=16576,
> data=TCP(seq=3804512443L, off_x2=128, ack=4079882712L, win=260,
> sum=14104, flags=24, dport=37000, sport=22, data='SSH-2.0-5.25
> FlowSsh: Bitvise SSH Server (WinSSHD) 6.07: free only for personal
> non-commercial use\r\n')))
> ----------------------------------------------------------------
只需在网上即可修改数据包。
感谢您的帮助