Question

我要制作自己的python嗅探器，但在解压缩arp协议标头时遇到问题。

这是我的代码：

def Sniffer():
    try:
        # AF_PACKET, That's basically packet level.
        # 0X0003, That's every packet. (We can find it here: /usr/include/linux/if_ether.h) 
        SK = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.ntohs(0x0003))
    except socket.error as MSG:
        print "Socket creation error:\n", MSG

    try:
        while True:
            Receive = SK.recvfrom(65565)
            Packet = Receive[0]
            Ethernet(Packet)
    except socket.error as MSG:
        print "Receive error:\n", MSG



# Ethernet Decapsulation (We need EtherType field value)
def Ethernet(Packet):
    ETHERNET_LENGTH = 14
    ETHERNET_HEADER = Packet[:ETHERNET_LENGTH]
    ETHERNET_HEADER_UNPACK = struct.unpack("!6s6sH", ETHERNET_HEADER)

    EtherType = ETHERNET_HEADER_UNPACK[2]
    print EtherType

    if EtherType == 2054:
        ARP(ETHERNET_LENGTH, Packet)
    if EtherType == 2048:
        IPV4(Packet)



# ARP Decapsulation (We need OPCODE field value)
def ARP(ETHERNET_LENGTH, Packet):
    ARP_LENGTH = 42
    ARP_HEADER = Packet[ETHERNET_LENGTH:ARP_LENGTH]
    ARP_HEADER_UNPACK = struct.unpack("!2s2s1s1s2s6s4s6s4s", ARP_HEADER)

    OPCODE = ARP_HEADER_UNPACK[4]

    if OPCODE == 1:
        print "ARP Request (Some one scann your network)"

那是我的错误：

Traceback (most recent call last):
  File "HoneySniffer.py", line 130, in <module>
    Sniffer()
  File "HoneySniffer.py", line 22, in Sniffer
    Ethernet(Packet)
  File "HoneySniffer.py", line 38, in Ethernet
    ARP(ETHERNET_LENGTH, Packet)
  File "HoneySniffer.py", line 48, in ARP
    ARP_HEADER_UNPACK = struct.unpack("!2s2s1s1s2s6s4s6s4s", ARP_HEADER)
struct.error: unpack requires a string argument of length 28

为什么会这样？
我该如何解决？

我在这里找到它：Python arp sniffing raw socket no reply packets

Answer 1

我遇到了完全相同的问题，我使用您的参考链接Python arp sniffing raw socket no reply packets解决了这个问题，并很少进行研究。

conn=socket.socket(socket.AF_PACKET,socket.SOCK_RAW,socket.ntohs(0x0003))

def arp_header(packet):

(a ,b ,c ,d ,e ,f ,g ,h ,i ) = struct.unpack('2s2s1s1s2s6s4s6s4s',packet[14:42])

hw_type=(binascii.hexlify(a)).decode('utf-8')
proto_type=(binascii.hexlify(b)).decode('utf-8')
hw_size=(binascii.hexlify(c)).decode('utf-8')
proto_size=(binascii.hexlify(d)).decode('utf-8')
opcode=(binascii.hexlify(e)).decode('utf-8')

return (hw_type,proto_type,hw_size,proto_size,opcode,socket.inet_ntoa(g),socket.inet_ntoa(i))

使用struct.unpack('2s2s1s1s2s6s4s6s4s',packet[14:42]) 不是struct.unpack('!2s2s1s1s2s6s4s6s4s',packet[14:42]) 这解决了我的struct.error: unpack requires a string argument of length 28错误

由于我的项目要求，我还使用了单个变量，

现在，为了进行调试，我使用了print(packet[14:42])-这给了我字节十六进制字面量（例如b'\x00\x01\x08\x00\x06\x04\x00\x01\xe4\x11[I&\xbe\n\x00.....等）

所以我必须在使用hexlify之后在utf-8中解码，因为hexlify再次将字节对象返回给我。

我使用的Python版本：3.6.5

日期：2019年4月3日

结果：- Arp Packet: - H/W Type: 0001, Protocol Type: 0800, H/W Size: 06 ,Protocol Size: 04 - Opcode: 0001, Source IP: 10.0.15.141, Destination IP: 10.0.10.2

判决：这种方法对我有用，我希望它也对您有用：）

python arp标头与结构模块解包

1 个答案: