I have a simple python script, that creates a socket AF_PACKET, which parses all IPv4 packets and retrieves the source and destination IP addresses:
import socket
import struct
def get_ip(s):
return '.'.join([str(ord(symbol)) for symbol in s])
def main():
conn = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.ntohs(3))
while True:
pkt, addr = conn.recvfrom(65536)
proto = struct.unpack('! H', pkt[12:14])
eth_proto = socket.htons(proto[0])
print('eth_proto = ', eth_proto)
if eth_proto == 8:
src, target = struct.unpack('! 4s 4s', pkt[26:34])
source_ip = get_ip(src)
destination_ip = get_ip(target)
print('Source IP = ', source_ip)
print('Destination IP = ', destination_ip)
main()
Is it possible to refactor getting the IP address, so it will look better and doesn't use this loop:
'.'.join([str(ord(symbol)) for symbol in s])
Format characters is described here: https://docs.python.org/2/library/struct.html
get_ipfunction and the desired output for that.