运行Python包嗅探器问题

Question

我创建了一个Python代码，它是一个基本的包嗅探器。代码编译时运行它不会给出错误，但也没有输出。我的主要问题是代码出了什么问题。接受建议。我在OS X上使用了IDLE和coderunner来试图获得正在运行的程序。

这是我迄今为止感谢的。

import socket 
import struct 
import textwrap 

TAB_1 = '\t - ' 
TAB_2 = '\t\t - ' 
TAB_3 = '\t\t\t - ' 
TAB_4 = '\t\t\t\t - ' 

DATA_TAB_1 = '\t ' 
DATA_TAB_2 = '\t\t ' 
DATA_TAB_3 = '\t\t\t ' 
DATA_TAB_4 = '\t\t\t\t ' 


def main(): 
    pcap = Pcap('capture.pcap') 
    conn = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.ntohs(3)) 

    while True: 
     raw_data, addr = conn.recvfrom(65535) 
     pcap.write(raw_data) 
     eth = Ethernet(raw_data) 

     print('\nEthernet Frame:') 
     print(TAB_1 + 'Destination: {}, Source: {}, Protocol: {}'.format(eth.dest_mac, eth.src_mac, eth.proto)) 

     # IPv4 
     if eth.proto == 8: 
      ipv4 = IPv4(eth.data) 
      print(TAB_1 + 'IPv4 Packet:') 
      print(TAB_2 + 'Version: {}, Header Length: {}, TTL: {},'.format(ipv4.version, ipv4.header_length, ipv4.ttl)) 
      print(TAB_2 + 'Protocol: {}, Source: {}, Target: {}'.format(ipv4.proto, ipv4.src, ipv4.target)) 

      # ICMP 
      if ipv4.proto == 1: 
       icmp = ICMP(ipv4.data) 
       print(TAB_1 + 'ICMP Packet:') 
       print(TAB_2 + 'Type: {}, Code: {}, Checksum: {},'.format(icmp.type, icmp.code, icmp.checksum)) 
       print(TAB_2 + 'ICMP Data:') 
       print(format_multi_line(DATA_TAB_3, icmp.data)) 

      # TCP 
      elif ipv4.proto == 6: 
       tcp = TCP(ipv4.data) 
       print(TAB_1 + 'TCP Segment:') 
       print(TAB_2 + 'Source Port: {}, Destination Port: {}'.format(tcp.src_port, tcp.dest_port)) 
       print(TAB_2 + 'Sequence: {}, Acknowledgment: {}'.format(tcp.sequence, tcp.acknowledgment)) 
       print(TAB_2 + 'Flags:') 
       print(TAB_3 + 'URG: {}, ACK: {}, PSH: {}'.format(tcp.flag_urg, tcp.flag_ack, tcp.flag_psh)) 
       print(TAB_3 + 'RST: {}, SYN: {}, FIN:{}'.format(tcp.flag_rst, tcp.flag_syn, tcp.flag_fin)) 

       if len(tcp.data) > 0: 

        # HTTP 
        if tcp.src_port == 80 or tcp.dest_port == 80: 
         print(TAB_2 + 'HTTP Data:') 
         try: 
          http = HTTP(tcp.data) 
          http_info = str(http.data).split('\n') 
          for line in http_info: 
           print(DATA_TAB_3 + str(line)) 
         except: 
          print(format_multi_line(DATA_TAB_3, tcp.data)) 
        else: 
         print(TAB_2 + 'TCP Data:') 
         print(format_multi_line(DATA_TAB_3, tcp.data)) 

      # UDP 
      elif ipv4.proto == 17: 
       udp = UDP(ipv4.data) 
       print(TAB_1 + 'UDP Segment:') 
       print(TAB_2 + 'Source Port: {}, Destination Port: {}, Length: {}'.format(udp.src_port, udp.dest_port, udp.size)) 

      # Other IPv4 
      else: 
       print(TAB_1 + 'Other IPv4 Data:') 
       print(format_multi_line(DATA_TAB_2, ipv4.data)) 

     else: 
      print('Ethernet Data:') 
      print(format_multi_line(DATA_TAB_1, eth.data)) 

# Returns MAC as string from bytes (ie AA:BB:CC:DD:EE:FF) 
def get_mac_addr(mac_raw): 
    byte_str = map('{:02x}'.format, mac_raw) 
    mac_addr = ':'.join(byte_str).upper() 
    return mac_addr 

def ipv4_packet(self, raw_data): 
     version_header_length = raw_data[0] 
     self.version = version_header_length >> 4 
     self.header_length = (version_header_length & 15) * 4 
     self.ttl, self.proto, src, target = struct.unpack('! 8x B B 2x 4s 4s', raw_data[:20]) 
     self.src = self.ipv4(src) 
     self.target = self.ipv4(target) 
     self.data = raw_data[self.header_length:] 

# Returns properly formatted IPv4 address 
def ipv4(self, addr): 
    return '.'.join(map(str, addr)) 

def icmp_packet(self, raw_data): 
     self.type, self.code, self.checksum = struct.unpack('! B B H', raw_data[:4]) 
     self.data = raw_data[4:] 

def tcp_segment(self, raw_data): 
     (self.src_port, self.dest_port, self.sequence, self.acknowledgment, offset_reserved_flags) = struct.unpack(
      '! H H L L H', raw_data[:14]) 
     offset = (offset_reserved_flags >> 12) * 4 
     self.flag_urg = (offset_reserved_flags & 32) >> 5 
     self.flag_ack = (offset_reserved_flags & 16) >> 4 
     self.flag_psh = (offset_reserved_flags & 8) >> 3 
     self.flag_rst = (offset_reserved_flags & 4) >> 2 
     self.flag_syn = (offset_reserved_flags & 2) >> 1 
     self.flag_fin = offset_reserved_flags & 1 
     self.data = raw_data[offset:] 

def udp_segment(self, raw_data): 
     self.src_port, self.dest_port, self.size = struct.unpack('! H H 2x H', raw_data[:8]) 
     self.data = raw_data[8:]   

# Formats multi-line data 
def format_multi_line(prefix, string, size=80): 
    size -= len(prefix) 
    if isinstance(string, bytes): 
     string = ''.join(r'\x{:02x}'.format(byte) for byte in string) 
     if size % 2: 
      size -= 1 
    return '\n'.join([prefix + line for line in textwrap.wrap(string, size)]) 

好奇心...... thenewboston

Answer 1

我已经使用空闲和coderunner在OS X上，试图得到一个正在运行的程序。

...

conn = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.ntohs(3))

这不会在OS X上工作; OS X没有AF_PACKET作为地址系列。我很惊讶你的程序没有失败，只有一个例外。

如果你要捕获数据包流量，你应该使用pcap;您已经在使用它来编写捕获文件，您应该使用它来捕获数据包。它将使用OS的机制（在OS X上的BPF，* BSD，AIX和Solaris 11; Linux上的AF_PACKET套接字等）来捕获数据包。