python嗅探器_Python中的简单原始数据包嗅探器

首先,我是python的初学者.我利用在第2层运行的PF_PACKET接口开发了一个简单的原始数据包嗅探器.

嗅探器只是找出以下内容…

-以太网头(源-目标-协议)

-IP标头(源IP-目标IP)

-TCP标头(源端口-目标端口)

这是我到目前为止编写的代码…

#!/usr/bin/env python

import struct

import socket

import binascii

rawSocket=socket.socket(socket.PF_PACKET,socket.SOCK_RAW,socket.htons(0x0800))

#ifconfig eth0 promisc up

receivedPacket=rawSocket.recv(2048)

#Ethernet Header...

ethernetHeader=receivedPacket[0][0:14]

ethrheader=struct.unpack("!6s6s2s",ethernetHeader)

destinationIP= binascii.hexlify(ethrheader[0])

sourceIP= binascii.hexlify(ethrheader[1])

protocol= binascii.hexlify(ethrheader[2])

print "Destinatiom: " + destinationIP

print "Souce: " + sourceIP

print "Protocol: "+ protocol

#IP Header...

ipHeader=receivedPacket[0][14:34]

ipHdr=struct.unpack("!12s4s4s",ipHeader)

destinationIP=socket.inet_ntoa(ipHdr[2])

print "Source IP: " +sourceIP

print "Destination IP: "+destinationIP

#TCP Header...

tcpHeader=receivedPacket[0][34:54]

tcpHdr=struct.unpack("!2s2s16s",tcpHeader)

sourcePort=socket.inet_ntoa(tcpHdr[0])

destinationPort=socket.inet_ntoa(tcpHdr[1])

print "Source Port: " + sourcePort

print "Destination Port: " + destinationPort

我似乎在以太网头部分和无法弄清的解压缩方法中遇到了问题.提前致谢 ：)