CODEWITHSUNDEEP
pythonpython-2.7tcpdhcpscapy
slyFox
slyFox

Reputation: 51

How do you properly modify packet data in Scapy?

I’ve been using Scapy a bit and have been messing around with making packets. A problem I have is trying to specify certain data/options in packets. For example, I want to make a DHCP packet with option 60 but I don’t know what is valid input data to use for this. I know the packet should have a DHCP.options list and I can add options like this into the list, but how do I know what type and what range of data I can actually use? I also know I can type DHCPOptions at the interpreter to see that it’s a ‘vendor class id’, but how would I actually properly add it to a packet?

Another example: for a TCP timestamp option, I discovered that I have to enter that as (‘Timestamp’, (int,int)), in other words a tuple of the string Timestamp and a tuple within that tuple of two integers, within some sort of range I don’t know.

So ultimately, my question is where/how do I find out how to add valid input data into packets in Scapy? Is there a list or documentation somewhere? I’ve searched around but couldn’t find it even in the source code and the documentation doesn’t seem helpful at all. Help is greatly appreciated!

Sample code: 

p = Ether()/IP()/UDP()/BOOTP()/DHCP()

# ?:what goes in the list to correctly add any option?
p[DHCP].options = [(?,?)]

# Trying to add option 60 here, unsure how
p[DHCP].options.append( ('vendor_class_id', ?) )

I use option 60 merely as an example, but I want to know how to add any valid option.

Upvotes: 1

Views: 1729

Answers (1)

macfij
macfij

Reputation: 3209

well, this might not be the full answer, since i also found it hard to find such info, but...

for some options, you can check in dhcp.py how they are defined in DHCPOptions dictionary - for example, you see that renewal_time by its definition is of int type and as default set to 21600 - IntField("renewal_time", 21600).

for other info, i suggest to dig through RFCs. for example, RFC 2132 describes DHCP Options and BOOTP Vendor Extensions.
RFC 1497 solely refers to Vendor options.

Upvotes: 1

Related Questions