python - 使用 Scapy 时 ICMP Ping 数据包未生成回复

Question

我最近开始探索 Scapy。确实是一个很棒的工具!

我有一个问题...当我使用 Wireshark 监控我的网卡并使用标准 PING 安装从系统命令提示符执行常规 ping 时，wireshark 弹出“Ping 请求”，然后是“Ping 回复”指示它发送了回复。但是当我在 Scapy 中手动执行时，它没有回复。这怎么可能？我花了很多时间试图解决这个问题，所以我真的希望有人能对我的这个问题有所了解......

这是我使用的代码:

>>> from scapy.all import IP, ICMP, send
>>> IP = IP(dst="127.0.0.1")
>>> Ping = ICMP()
>>> send(IP/Ping)

数据包发送成功，Wireshark 显示收到 Ping 请求，但未返回回复。

Answer 1

这是一个 FAQ item :

I can't ping 127.0.0.1. Scapy does not work with 127.0.0.1 or on the loopback interface

The loopback interface is a very special interface. Packets going through it are not really assembled and dissassembled. The kernel routes the packet to its destination while it is still stored an internal structure. What you see with tcpdump -i lo is only a fake to make you think everything is normal. The kernel is not aware of what Scapy is doing behind his back, so what you see on the loopback interface is also a fake. Except this one did not come from a local structure. Thus the kernel will never receive it.

In order to speak to local applications, you need to build your packets one layer upper, using a PF_INET/SOCK_RAW socket instead of a PF_PACKET/SOCK_RAW (or its equivalent on other systems that Linux) :

>>> conf.L3socket
<class __main__.L3PacketSocket at 0xb7bdf5fc>
>>> conf.L3socket=L3RawSocket
>>> sr1(IP(dst="127.0.0.1")/ICMP())
<IP  version=4L ihl=5L tos=0x0 len=28 id=40953 flags= frag=0L ttl=64 proto=ICMP chksum=0xdce5 src=127.0.0.1 dst=127.0.0.1 options='' |<ICMP  type=echo-reply code=0 chksum=0xffff id=0x0 seq=0x0 |>>