Skip to content

Instantly share code, notes, and snippets.

@krsna1729
Created June 1, 2019 00:02
Show Gist options
  • Save krsna1729/cedab96420fb4dae7c5f44bbc00f4bc1 to your computer and use it in GitHub Desktop.
Save krsna1729/cedab96420fb4dae7c5f44bbc00f4bc1 to your computer and use it in GitHub Desktop.
how to send arp request using scapy
>>> pkt=Ether(dst="ff:ff:ff:ff:ff:ff")/ARP(pdst="198.18.0.2", hwsrc="7a:6c:00:af:eb:89")
>>> pkt.show()                                                                                                                                                                                  ###[ Ethernet ]###
  dst       = ff:ff:ff:ff:ff:ff
  src       = 7a:6c:00:af:eb:89
  type      = 0x806
###[ ARP ]###
     hwtype    = 0x1
     ptype     = 0x800
     hwlen     = None
     plen      = None
     op        = who-has
     hwsrc     = 7a:6c:00:af:eb:89
     psrc      = 198.18.0.1
     hwdst     = None
     pdst      = 198.18.0.2

>>> hexdump(pkt)
0000  FF FF FF FF FF FF 7A 6C 00 AF EB 89 08 06 00 01  ......zl........
0010  08 00 06 04 00 01 7A 6C 00 AF EB 89 C6 12 00 01  ......zl........
0020  00 00 00 00 00 00 C6 12 00 02                    ..........
>>> sendp(pkt, iface="foo")                                                                                                                                                                     .
Sent 1 packets.
# tcpdump -i foo -Xe
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on foo, link-type EN10MB (Ethernet), capture size 262144 bytes
23:44:11.844713 7a:6c:00:af:eb:89 (oui Unknown) > Broadcast, ethertype ARP (0x0806), length 42: Request who-has 198.18.0.2 tell 198.18.0.1, length 28
        0x0000:  0001 0800 0604 0001 7a6c 00af eb89 c612  ........zl......
        0x0010:  0001 0000 0000 0000 c612 0002            ............
# tcpdump -i foo-vdev -Xe
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on foo-vdev, link-type EN10MB (Ethernet), capture size 262144 bytes
23:45:57.056733 7a:6c:00:af:eb:89 (oui Unknown) > Broadcast, ethertype ARP (0x0806), length 42: Request who-has 198.18.0.2 tell 198.18.0.1, length 28
        0x0000:  0001 0800 0604 0001 7a6c 00af eb89 c612  ........zl......
        0x0010:  0001 0000 0000 0000 c612 0002            ............
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment