python arp header使用struct模块解压缩

Question

我要制作我自己的python嗅探器，但我解压缩arp协议头有问题。

这是我的代码：

def Sniffer():
    try:
        # AF_PACKET, That's basically packet level.
        # 0X0003, That's every packet. (We can find it here: /usr/include/linux/if_ether.h) 
        SK = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.ntohs(0x0003))
    except socket.error as MSG:
        print "Socket creation error:\n", MSG

    try:
        while True:
            Receive = SK.recvfrom(65565)
            Packet = Receive[0]
            Ethernet(Packet)
    except socket.error as MSG:
        print "Receive error:\n", MSG



# Ethernet Decapsulation (We need EtherType field value)
def Ethernet(Packet):
    ETHERNET_LENGTH = 14
    ETHERNET_HEADER = Packet[:ETHERNET_LENGTH]
    ETHERNET_HEADER_UNPACK = struct.unpack("!6s6sH", ETHERNET_HEADER)

    EtherType = ETHERNET_HEADER_UNPACK[2]
    print EtherType

    if EtherType == 2054:
        ARP(ETHERNET_LENGTH, Packet)
    if EtherType == 2048:
        IPV4(Packet)



# ARP Decapsulation (We need OPCODE field value)
def ARP(ETHERNET_LENGTH, Packet):
    ARP_LENGTH = 42
    ARP_HEADER = Packet[ETHERNET_LENGTH:ARP_LENGTH]
    ARP_HEADER_UNPACK = struct.unpack("!2s2s1s1s2s6s4s6s4s", ARP_HEADER)

    OPCODE = ARP_HEADER_UNPACK[4]

    if OPCODE == 1:
        print "ARP Request (Some one scann your network)"    

那是我的错误：

Traceback (most recent call last):
  File "HoneySniffer.py", line 130, in <module>
    Sniffer()
  File "HoneySniffer.py", line 22, in Sniffer
    Ethernet(Packet)
  File "HoneySniffer.py", line 38, in Ethernet
    ARP(ETHERNET_LENGTH, Packet)
  File "HoneySniffer.py", line 48, in ARP
    ARP_HEADER_UNPACK = struct.unpack("!2s2s1s1s2s6s4s6s4s", ARP_HEADER)
struct.error: unpack requires a string argument of length 28

为什么会这样？ 我该如何解决？

我在这里找到它：Python arp sniffing raw socket no reply packets

Answer 1

我有完全相同的问题，我使用你的参考链接Python arp sniffing raw socket no reply packets和我自己的小研究解决了它。

---

conn=socket.socket(socket.AF_PACKET,socket.SOCK_RAW,socket.ntohs(0x0003))

def arp_header(packet):

(a ,b ,c ,d ,e ,f ,g ,h ,i ) = struct.unpack('2s2s1s1s2s6s4s6s4s',packet[14:42])

hw_type=(binascii.hexlify(a)).decode('utf-8')
proto_type=(binascii.hexlify(b)).decode('utf-8')
hw_size=(binascii.hexlify(c)).decode('utf-8')
proto_size=(binascii.hexlify(d)).decode('utf-8')
opcode=(binascii.hexlify(e)).decode('utf-8')

return (hw_type,proto_type,hw_size,proto_size,opcode,socket.inet_ntoa(g),socket.inet_ntoa(i))

---

使用struct.unpack('2s2s1s1s2s6s4s6s4s',packet[14:42])而不是struct.unpack('!2s2s1s1s2s6s4s6s4s',packet[14:42])这解决了我的struct.error: unpack requires a string argument of length 28错误

由于我的项目要求，我也使用了个别变量，

现在，为了调试我使用print(packet[14:42]) - 它给了我字节十六进制文字（如b'\x00\x01\x08\x00\x06\x04\x00\x01\xe4\x11[I&\xbe\n\x00.....等）

所以我必须在使用hexlify后在utf-8中解码，因为hexlify再次向我返回字节对象。

我使用的Python版本：3.6.5

日期：03 /四月/ 2019

结果：

- Arp Packet:
         - H/W Type: 0001, Protocol Type: 0800, H/W Size: 06 ,Protocol Size: 04
         - Opcode: 0001, Source IP: 10.0.15.141, Destination IP: 10.0.10.2

结论：这个方法对我有用，我希望它对你也有用:)