Last active
July 28, 2018 20:24
-
-
Save ZuZuD/b9a0187ae7061d20c3a3b71845afb90a to your computer and use it in GitHub Desktop.
TCP states break down with Scappy
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
from scapy.all import * | |
import time | |
import random | |
def sendit(src=None, dst=None, dport=None): | |
""" | |
See the different status of a TCP connection | |
Was initially written to identify a docker-proxy bug: https://github.com/moby/moby/issues/27539 | |
I suggest to keep a netstat running from the server side: $ watch -0.1 'netstat -laptn|grep 80' | |
Note: linux will send an RST because the packet is not issued from the kernel. Disable it by executing: | |
$ iptables -A OUTPUT -p tcp --tcp-flags RST RST -s <src_ip> -j DROP | |
""" | |
sport = random.randint(1024,65535) | |
ip=IP(src=src, dst=dst) | |
SYN=TCP(sport=sport,dport=dport,flags='S',seq=1000) | |
SYNACK=sr1(ip/SYN) | |
print("SYN/ACK sent to {}:{} using {}:{}".format(ip.dst, dport, ip.src, sport)) | |
time.sleep(4) | |
# SYN-RECV server-side | |
ACK=TCP(sport=sport, dport=dport, flags='A', seq=SYNACK.ack + 1, ack=SYNACK.seq +1) | |
send(ip/ACK) | |
print('Sending ACK - Three-way handshake over') | |
time.sleep(4) | |
# ESTABLISHED | |
FIN=TCP(sport=sport, dport=dport, flags="FA", seq=SYNACK.ack, ack=SYNACK.seq + 1) | |
FINACK=sr1(ip/FIN) | |
print("Sending FIN/ACK - End of tcp connection") | |
time.sleep(4) | |
# LAST-ACK | |
LASTACK=TCP(sport=sport, dport=dport, flags="A", seq=FINACK.ack, ack=FINACK.seq + 1) | |
print("Last ACK sent - The session {}:{} establised to {}:{} is now closed".format(ip.src, sport, dst, dport)) | |
time.sleep(4) | |
send(ip/LASTACK) | |
# connection closed | |
if __name__ == '__main__': | |
sendit(src='172.31.29.249',dst='172.31.46.210',dport=80) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment