[scapy] Linux-Cooked pcap to ethernet

-
# The pcap file formatted by "Linux cooked"
# tcpdump -r myfile.pcap -nn
reading from file event1.pcap, link-type LINUX_SLL (Linux cooked)
...
...

# step1. read myfile.pcap
pkts = rdpcap("myfile.pcap");
# step2. read myfile.pcap
pkts = [Ether(src='00:11:22:33:44:55', dst='22:33:44:55:66:77')/pkt[1:] for pkt in pkts]
# step3. modify IP address and recalculate chksum
for pkt in pkts:
 pkt[1].dst='192.168.1.10';
 pkt[1].src='192.168.1.1';
 del pkt[IP].chksum
 del pkt[UDP].chksum
# step4. packet send
sendp(pkts[0]);

# step5. save pcap
 wrpcap("output.pcap",pkts);


# tcpdump -r output.pcap -nn
reading from file output.pcap, link-type EN10MB (Ethernet)
...
...

# pkt[1:] : It means IP layer
1) Before: Linux cooked / IP / UDP / UDP-Data
2) After: Ethernet / IP / UDP / UDP-Data

Comments

Post a Comment

Popular posts from this blog

[WordPress] Change https redirect in DB.

-
If you make an https redirect without thinking about SSL configuration: Check DB SELECT * from wp_options where option_name IN ('siteurl', 'home'); Update UPDATE wp_options SET option_value = REPLACE(option_value, 'https://your_domain', 'http://your_domain') WHERE option_name IN ('siteurl', 'home');
Read more

sanitize on in CMakeLists.txt

-
1. CMakeLists.txt set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fsanitize=address") add_compile_options(-fsanitize=address) If a subdir is set with add_subdirectory and a module that does not support sanitize is imported from the path and needs to be removed, add -fno-sanitize=address to add_compile_options in CMakeLists.txt of the subdir to remove it. Basically, if you enable sanitize, sanitize will adjust ulimit's core to 0, so core will not occur. You can do this by putting the following part as an environment variable. (Below is the part you put in systemd's service) 2. service file in systemd [Service] LimitCORE=infinity Environment="ASAN_OPTIONS=handle_segv=0:handle_abort=1:abort_on_error=1:disable_coredump=0"
Read more