Fun with Scapy

Scapy belongs in any Pythonic Network Engineer's tool bag, IMHO. It allows you to craft your own packet from the ground up. Basically any high level tools you use (nmap, ping, traceroute) is limited by the intention of the creator of the tool, say, if I create a tool called eric-ping and uses IMCP ping, you as the user cannot use TCP ping unless I provide that as an option to you.

But with Scapy, it allows you to craft your own packet at each layer, and take defaults whenever possible to save you time.  Best yet, it takes after the Python object model and leverage what you already know about Python.

The creator of the tool wrote a detail interactive tutorial that is pretty easy to follow:
http://www.secdev.org/projects/scapy/doc/usage.html#interactive-tutorial

Here is the project homepage:
http://www.secdev.org/projects/scapy/

Here is another intro from PacketLife.net:
http://packetlife.net/blog/2011/may/23/introduction-scapy/

I would encourage the motivated to walk thru the tutorial on the Scapy site. Here is my own little experiment:

1. Create a list of eCommerce sites to query port 80 from:

>>> 

>>> ecommerceSites = ["www.overstock.com", "www.ebay.com"]

2. Get the results back: 

>>> answered, unanswered = sr(IP(dst=ecommerceSites)/TCP(dport=(80)))

Begin emission:

....Finished to send 2 packets.

.*….*

Received 11 packets, got 2 answers, remaining 0 packets

3. Pretty print it with socket module to get the DNS name back: 

>>> answered.make_lined_table(lambda (sender,response): ("Commerce Sites", str(socket.gethostbyaddr(sender.dst)), response.sprintf("%IP.src% %IP.proto% %TCP.sport%")))

------------------------------------------+-------------------------+

                                          | Commerce Sites | 

------------------------------------------+-------------------------+

('overstock.com', [], ['173.241.154.10']) | 173.241.154.10 tcp http | 

('www.ebay.com', [], ['66.211.181.161']) | 66.211.181.161 tcp http | 

------------------------------------------+-------------------------+

>>> 

>>> 

I cheated a litte on the example above by not include any sites that uses Akami VIP (www.buy.com, www.zappos.com, etc) or no reverse lookup (amazon.com) to make the result more clear and meaningful. 

Perhaps after I get more experience with the tool I will report back with some more examples. I have some aspiration for projects after seeing how powerful the tool is.