Example of python parsing data packets sent to the local machine (parsing data packets)

This article describes how to use python to parse and print data packets sent to the local machine. For more information, see tcp. py.

The code is as follows:

#-*-Coding: cp936 -*-
Import socket
From struct import *
From time import ctime, sleep
From OS import system

System ('title tcp sniffer ')
System ('color 05 ')

# The public network interface
HOST = socket. gethostbyname (socket. gethostname ())

# Create a raw socket and bind it to the public interface
S = socket. socket (socket. AF_INET, socket. SOCK_RAW, socket. IPPROTO_IP)
S. bind (HOST, 0 ))

# Include IP headers
S. setsockopt (socket. IPPROTO_IP, socket. IP_HDRINCL, 1)

# Receive all packages
# S. ioctl (socket. SIO_RCVALL, socket. RCVALL_ON)

# Receive a package
While 1 = 1:
Packet = s. recvfrom (65565)
Packet = packet [0]

Ip_header = packet [0: 20]
Iph = unpack ('! BBHHHBBH4s4s ', ip_header)
Version = iph [0]> 4 # Version
Ihl = iph [0] * 0xF # IHL
Iph_length = ihl * 4 # Total Length
Ttl = iph [5]
Protocol = iph [6]
S_addr = socket. inet_ntoa (iph [8])
D_addr = socket. inet_ntoa (iph [9])
Print ctime ()
Print 'version: '+ str (Version) + 'ihl:' + str (IHL) + 'total Length: '+ str (iph_length) + 'ttl: '+ str (ttl) + 'protocol:' + str (Protocol) + 'source Address: '+ str (s_addr) + 'Destination Address:' + str (d_addr)

If protocol = 6:
Tcp_header = packet [20: 40]
Tcph = unpack ('! HHLLBBHHH ', tcp_header)
Source_port = tcph [0]
Dest_port = tcph [1]
Sequence = tcph [2]
Acknowledgement = tcph [3]
Doff_reserved = tcph [4]
Tcph_length = doff_reserved> 4
Print 'source Port: '+ str (source_port) + 'destport:' + str (dest_port) + 'sequence Number: '+ str (Sequence) + 'Acknowledgement: '+ str (acknowledgement) + 'tcp header length:' + str (tcph_length)

Data = packet [40: len (packet)]
Print 'data: '+ Data

# Disabled promiscuous mode
S. ioctl (socket. SIO_RCVALL, socket. RCVALL_OFF)

Udp. py

The code is as follows:

#-*-Coding: cp936 -*-
Import socket
From struct import *
From time import ctime, sleep
From OS import system

System ('title udp sniffer ')
System ('color 05 ')
# The public network interface
HOST = socket. gethostbyname (socket. gethostname ())

# Create a raw socket and bind it to the public interface
S = socket. socket (socket. AF_INET, socket. SOCK_RAW, socket. IPPROTO_IP)
S. bind (HOST, 0 ))

# Include IP headers
S. setsockopt (socket. IPPROTO_IP, socket. IP_HDRINCL, 1)

# Receive all packages
# S. ioctl (socket. SIO_RCVALL, socket. RCVALL_ON)

# Receive a package
While 1 = 1:
Packet = s. recvfrom (65565)
Packet = packet [0]

Ip_header = packet [0: 20]
Iph = unpack ('! BBHHHBBH4s4s ', ip_header)
Version = iph [0]> 4 # Version
Ihl = iph [0] * 0xF # IHL
Iph_length = ihl * 4 # Total Length
Ttl = iph [5]
Protocol = iph [6]
S_addr = socket. inet_ntoa (iph [8])
D_addr = socket. inet_ntoa (iph [9])

If protocol = 17:
Udp_header = packet [20: 28]
Udph = unpack ('! Hhhh', udp_header)
Source_port = udph [0]
Dest_port = udph [1]
Length = udph [2]
Checksum = udph [3]
Data = packet [28: len (packet)]

Print ctime ()
Print 'version: '+ str (Version) + 'ihl:' + str (IHL) + 'total Length: '+ str (iph_length) + 'ttl: '+ str (ttl) + 'protocol:' + str (Protocol) + 'source Address: '+ str (s_addr) + 'Destination Address:' + str (d_addr)
Print 'source Port: '+ str (source_port) + 'destport:' + str (dest_port) + 'length: '+ str (Length) + 'checksum: '+ str (checksum)
Print 'data: '+ Data

# Disabled promiscuous mode
S. ioctl (socket. SIO_RCVALL, socket. RCVALL_OFF)