1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
|
#!/usr/bin/python
import os
import socket
import sys
import argparse
import outer_packages
from scapy.all import *
import texttable
class sock_driver(object):
args = None;
cap_server_port = None
def fail(msg):
print('\nError: %s\n' % msg)
sys.exit(1)
class CPcapFileReader:
def __init__ (self, file_name):
self.file_name = file_name
self.pkts = []
self.__build_pkts()
if not self.pkts:
fail('No payloads were found in the pcap.')
def __build_pkts(self):
if not os.path.exists(self.file_name):
fail('Filename %s does not exist!' % self.file_name)
pcap = RawPcapReader(self.file_name).read_all()
if not pcap:
fail('Empty pcap!')
first_tuple = None
for index, (raw_pkt, _) in enumerate(pcap):
scapy_pkt = Ether(raw_pkt)
# check L3
ipv4 = scapy_pkt.getlayer('IP')
ipv6 = scapy_pkt.getlayer('IPv6')
garbage = 0
if ipv4 and ipv6:
scapy_pkt.show2()
fail('Packet #%s in pcap has both IPv4 and IPv6!' % index)
elif ipv4:
l3 = ipv4
garbage = len(ipv4) - ipv4.len
elif ipv6:
l3 = ipv6
garbage = len(ipv6) - ipv6.plen - 40
else:
scapy_pkt.show2()
fail('Packet #%s in pcap is not IPv4/6.' % index)
# check L4
tcp = scapy_pkt.getlayer('TCP')
udp = scapy_pkt.getlayer('UDP')
if tcp and udp:
scapy_pkt.show2()
fail('Packet #%s in pcap has both TCP and UDP!' % index)
elif tcp:
l4 = tcp
elif udp:
l4 = udp
else:
scapy_pkt.show2()
fail('Packet #%s in pcap is not TCP or UDP.' % index)
pkt = {}
pkt['src_ip'] = l3.src
pkt['dst_ip'] = l3.dst
pkt['src_port'] = l4.sport
pkt['dst_port'] = l4.dport
if tcp:
pkt['tcp_seq'] = tcp.seq
if garbage:
pkt['pld'] = bytes(l4.payload)[:-garbage]
else:
pkt['pld'] = bytes(l4.payload)
if index == 0:
if tcp and tcp.flags != 2:
scapy_pkt.show2()
fail('First TCP packet should be with SYN')
first_tuple = (l3.dst, l3.src, l4.dport, l4.sport, l4.name)
sock_driver.cap_server_port = l4.dport
if first_tuple == (l3.dst, l3.src, l4.dport, l4.sport, l4.name):
pkt['is_client'] = True
elif first_tuple == (l3.src, l3.dst, l4.sport, l4.dport, l4.name):
pkt['is_client'] = False
else:
fail('More than one flow in this pcap.\nFirst tuple is: %s,\nPacket #%s has tuple: %s' % (first_tuple, (l3.dst, l3.src, l4.dport, l4.sport, l4.name)))
if pkt['pld']: # has some data
if tcp:
is_retransmission = False
# check retransmission and out of order
for old_pkt in reversed(self.pkts):
if old_pkt['is_client'] == pkt['is_client']: # same side
if old_pkt['tcp_seq'] == tcp.seq:
is_retransmission = True
if old_pkt['tcp_seq'] > tcp.seq:
fail('Out of order in TCP packet #%s, please check the pcap manually.' % index)
break
if is_retransmission:
continue # to next packet
self.pkts.append(pkt)
def dump_info(self):
t = texttable.Texttable(max_width = 200)
t.set_deco(0)
t.set_cols_align(['r', 'c', 'l', 'l', 'r', 'r', 'r'])
t.header(['Index', 'Side', 'Dst IP', 'Src IP', 'Dst port', 'Src port', 'PLD len'])
for index, pkt in enumerate(self.pkts):
t.add_row([index, 'Client' if pkt['is_client'] else 'Server', pkt['dst_ip'], pkt['src_ip'], pkt['dst_port'], pkt['src_port'], len(pkt['pld'])])
print(t.draw())
print('')
class CClientServerCommon(object):
def send_pkt(self, pkt):
self.connection.sendall(pkt)
print('>>> sent %d bytes' % (len(pkt)))
def rcv_pkt(self, pkt):
size = len(pkt)
rcv = b''
while len(rcv) < size:
chunk = self.connection.recv(min(size - len(rcv), 2048))
if not chunk:
raise Exception('Socket connection broken')
rcv += chunk
if len(rcv) != size:
fail('Size of data does not match.\nExpected :s, got: %s' % (size, len(rcv)))
if len(rcv) != len(pkt):
for i in range(size):
if rcv[i] != pkt[i]:
fail('Byte number #%s is expected to be: %s, got: %s.' % (i, rcv[i], pkt[i]))
print('<<< recv %d bytes' % (len(rcv)))
def process(self, is_client):
for pkt in self.pcapr.pkts:
time.sleep(sock_driver.args.ipg)
if is_client ^ pkt['is_client']:
self.rcv_pkt(pkt['pld'])
else:
self.send_pkt(pkt['pld'])
self.connection.close()
self.connection = None
class CServer(CClientServerCommon) :
def __init__ (self, pcapr, port):
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
server_address = ('', port)
print('Starting up on %sport %s' % ('%s ' % server_address[0] if server_address[0] else '', server_address[1]))
try:
sock.bind(server_address)
except socket.error as e:
fail(e)
sock.listen(1)
self.connection = None
self.pcapr=pcapr; # save the info
while True:
try:
# Wait for a connection
print('Waiting for new connection')
self.connection, client_address = sock.accept()
print('Got connection from %s:%s' % client_address)
self.process(False)
except KeyboardInterrupt:
print(' Ctrl+C')
break
except Exception as e:
print(e)
finally:
if self.connection :
self.connection.close()
self.connection = None
class CClient(CClientServerCommon):
def __init__ (self, pcapr, ip, port):
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server_address = (ip, port)
self.pcapr = pcapr # save the info
self.connection = None
try:
print('Connecting to %s:%s' % server_address)
sock.connect(server_address)
self.connection = sock
self.process(True);
except KeyboardInterrupt:
print(' Ctrl+C')
finally:
if self.connection :
self.connection.close()
self.connection = None
def process_options ():
parser = argparse.ArgumentParser(
description = 'Simulates TCP application in low rate by sending payloads of given pcap.',
usage="""
Server side: (should be run first, need sudo permissions to use server side ports lower than 1024.)
sock.py -s -f filename
Client side:
sock.py -c -f filename --ip <server ip>""",
epilog=" written by hhaim");
parser.add_argument("-f", dest = "file_name", required = True, help='pcap filename to process')
parser.add_argument('-c', action = 'store_true', help = 'client side flag')
parser.add_argument('-s', action = 'store_true', help = 'server side flag')
parser.add_argument('--port', type = int, help = 'server port, default is taken from the cap')
parser.add_argument('--ip', default = '127.0.0.1', help = 'server ip')
parser.add_argument('-i', '--ipg', type = float, default = 0.001, help = 'ipg (msec)')
parser.add_argument('-v', '--verbose', action='store_true', help = 'verbose')
sock_driver.args = parser.parse_args();
if not (sock_driver.args.c ^ sock_driver.args.s):
fail('You must choose either client or server side with -c or -s flags.');
def main ():
process_options ()
pcapr = CPcapFileReader(sock_driver.args.file_name)
if sock_driver.args.verbose:
pcapr.dump_info()
port = sock_driver.cap_server_port
if sock_driver.args.port:
port = sock_driver.args.port
if port == 22:
fail('Port 22 is used by ssh, exiting.')
if sock_driver.args.c:
CClient(pcapr, sock_driver.args.ip, port)
if sock_driver.args.s:
CServer(pcapr, port)
main()
|
