TimeStamp on ICMP on Scapy (Python)

24 Views Asked by At

Context

(If you are skilled in Scapy you may want to jump this part)

I was tasked to do some basic ICMP package that "doesn't look like a fake package". So I started writing some code in Python with Scapy libraries, somewhat like this:

import scapy.all as scapy
import scapy.layers.inet as inet
import scapy.fields as fields
import sys
import random
import os
import time


'''some other code...'''

def packbuilder(sec, messagechar):
    packet = inet.IP(src=configured_ips[0], dst=configured_ips[1])
    packet[inet.IP].ttl = 64
    packet[inet.IP].id = os.getpid() & 0xFFFF
    del packet[inet.IP].chksum
    packet = packet/inet.ICMP()
    packet[inet.ICMP].id = icmp_id
    packet[inet.ICMP].seq = sec
    del packet[inet.ICMP].chksum
    timestamp = int(time.time() * 10**9)
    datatime = scapy.struct.pack('<Q', timestamp)
    packet = packet / scapy.Raw(load=datatime + messagechar.encode() + b'\x00')
    return packet

The Issue

As you may all know, ICMP packages in Scapy are made by stacking layers one over the other, and within this layers there are what are called "fields". A "common" field that is in many ICMP packages is indeed Timestamp. As you can see, in the code (that I borrowed form a friend of friend), scapy adds datatime to scapy.Raw, which is the last layer of a Package in Scapy (Don't know if is actually mandatory to have it at last), and so it adds timestamp... except it doesn't

Actual Package seen in Wireshark

So I started loooking in Scapy's library and eventually I found what I was looking for with another problem, which is actually what this whole thing is about:

scapy.layers.inet.ICMPTimeStampField

Click here to see the actual reference

You may realize that unlike scapy.layers.inet.ICMP(), scapy.layers.inet.ICMPTimeStampField() isn't a packet, but a field, so you cannot stack it like you would stack a packet.

I've been reading the Scapy Fields Simple Datatypes but it seems that is for making new kinds of packages, and I don't want to make a new kind of package. I want to make a ICMP with a timestamp field, using scapy.layers.inet.ICMPTimeStampField() but I don't know how to use it.I might have to make a new kind of package (I know...) but at least that is for common us in ICMP methods.

import scapy.all as scapy
import scapy.layers.inet as inet
import scapy.fields as fields
import sys
import random
import os
import time


'''some other code...'''

def packbuilder(sec, messagechar):
    packet = inet.IP(src=configured_ips[0], dst=configured_ips[1])
    packet[inet.IP].ttl = 64
    packet[inet.IP].id = os.getpid() & 0xFFFF
    del packet[inet.IP].chksum
    packet = packet/inet.ICMP()
    packet[inet.ICMP].id = icmp_id
    packet[inet.ICMP].seq = sec
    del packet[inet.ICMP].chksum
    timestamp = int(time.time() * 10**9)
    datatime = scapy.struct.pack('<Q', timestamp)
    packet = packet / scapy.Raw(load=datatime + messagechar.encode() + b'\x00')
    return packet

What i really need is something like this:

Ideal Package

0

There are 0 best solutions below