I know there are lots of gaps in my current understanding of this. Why am I almost only catching ICMP packets? What is the purpose of these packets with localhost both as destination and source? How does the socket know which interface I want it to operate on? Also I've learned that network interfaces can be put into different modes like monitor or promiscuous, how does that relate to sockets and my goal of catching packets? Why is that? What is an address family how does it relate to sockets? Is there an alternative way to catch packets from lower levels? In Wireshark I can see ethernet datagrams, so it seems possible.Īs I've stated, I want to sniff all the traffic reaching my wifi interface. I soon found out that this address family is not available on macos (which I'm using). Initially, I saw some examples of creating a sniffer socket which used the AF_PACKET address family. Then, I'm binding the socket to 0.0.0.0 which supposedly means "any address" as described here. The last argument IPPROTO_IP just indicates that I want IP packets only. The socket type is set to SOCK_RAW meaning that I want the raw sockets as opposed to using SOCK_STREAM for TCP connections and SOCK_DGRAM for UDP. In my case, I'm selecting the AF_INET family which I don't really understand very well, but it seems to yield packets from the network layer. Raw_buffer = sock.recvfrom(PACKET_SIZE)įirst I'm creating a socket with socket.socket, where I specify address family, socket type and protocol. Sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_IP)
So, I have some questions which I'd like to get answered. Now, since my socket code only seemed to capture ICMP packets, I've been trying to configure it so that I can catch all traffic reaching my wifi interface, but I still almost exclusively see ICMP packets (with localhost as both source and destination). The problem is that all resources with thorough explanations cover the scenario of creating sockets for client/server data sending/receiving purposes.Īt this point, I've successfully created some classes that handle packet header decoding for IPv4 and ICMP. Thing is, it has turned out to be a tad bit more confusing than I initially anticipated. So I'm trying to build a packet sniffer in Python to deepen my understanding of networking.
0 kommentar(er)
