Question

我正在尝试解析来自RADIUS服务器的UDP数据包，我尝试过不同的工具，包括Scapy，Pynids和pypcap。问题是一些Radius-Attributes没有正确解码，其中一些是。可能是什么原因造成的？

这是我的代码：

from scapy.all import sniff, Radius

packets = sniff(iface='eth0', filter='udp', count=5)
packet = packets[0]

print packet.show()

以下是我得到的输出摘要：

###[ Ethernet ]### 
   dst       = 94:57:a5:53:ab:70
   src       = d4:ca:6d:ae:a0:66
   type      = 0x800
###[ UDP ]### 
   sport     = 38667
   dport     = radius
   len       = 205
   chksum    = 0x2bbd
###[ Radius ]### 
   code      = Access-Request
   id        = 80
   len       = 197
   authenticator= "T\xfb\x9c\t\x00 '\x14\xeb\x99\x84t\x9b\xb4\x83\x95"
   \attributes\
    |###[ Radius Attribute ]### 
    |  type      = Framed-Protocol
    |  len       = 6
    |  value     = '\x00\x00\x00\x01'
    |###[ Radius Attribute ]### 
    |  type      = NAS-Port
    |  len       = 6
    |  value     = '\x00\xf6\xa7\xf9'
    |###[ Radius Attribute ]### 
    |  type      = Called-Station-Id
    |  len       = 8
    |  value     = 'Dslam1'
    |###[ Radius Attribute ]### 
    |  type      = 87
    |  len       = 16
    |  value     = 'ether1-Dslam 1'
    |###[ Radius Attribute ]### 
    |  type      = Vendor-Specific
    |  len       = 24
    |  value     = '\x00\x00\x017\x0b\x12\x19\xfc4\xd01\xaf\x03\xd6\x0e!j\xa7H]\xdd;'
    |###[ Radius Attribute ]### 
    |  type      = NAS-Identifier
    |  len       = 15
    |  value     = 'TEH-P'

Answer 1

对于未来的访问者，这就是我设法解析数据包的方式。

您需要在当前目录中创建字典文件或使用here中的示例，以便它可以正确解析您的数据类型。

from pyrad.packet import Packet
from pyrad.dictionary import Dictionary

from scapy.all import sniff, Radius

def parse_packet(packet):
    radius_packet = str(packet[Radius])
    pkt = Packet(packet=radius_packet, dict=Dictionary("dictionary"))

    for key, value in pkt.iteritems():
        attr =  pkt._DecodeKey(key)
        value = pkt.__getitem__(attr)
        print attr, value

sniff(iface='eth0', prn=parse_packet, filter="udp", store=0)

这是我得到的回复样本：

User-Name [u'12345678']
NAS-IP-Address ['192.168.*.*']
NAS-Port [15853417]
Service-Type ['Framed-User']
Framed-Protocol ['PPP']
Framed-IP-Address ['192.168.*.*']
Called-Station-Id [u'service4']
Calling-Station-Id [u'20:A7:5C:75:RA:TD']
NAS-Identifier [u'Test']
Acct-Status-Type ['Alive']
Acct-Delay-Time [0]
Acct-Input-Octets [1003335]
Acct-Output-Octets [15399190]
Acct-Session-Id [u'81c2332b']
Acct-Authentic ['RADIUS']
Acct-Session-Time [76321]
Acct-Input-Packets [15498]
Acct-Output-Packets [21247]

Python如何解析RADIUS服务器数据包？

1 个答案: