scapy & dns sec

[Scapy][bug]Memory leak in sendp() function

Hi!

Great thx from happy Scapy user! :)

I experience a problem with memory leak(s) in sendp() function (I 
suppose): sending more than 30 000 packets with sendp() cause FreeBSD to 
kill python's process due to his large size in memory (over 3 Gb!). 
Please, fix it! :(

I wrote short test with some debug information - he tries to send 
10000000 packets with sendp(). FreeBSD 8.2+ x86 (scapy 2.2.0, 2.1.1) 
fails approximately at 30 000'th packet. Here it is:
<test begin>
#! /usr/bin/env python
# -*- coding: utf-8 -*-

from scapy.all import *
from scapy.layers.inet import IP, TCP, UDP, ICMP
from scapy.layers.sctp import SCTP
from commands import *

import gc
import pdb

def printAllGcObjs():
   i = 0
   sum = 0
   for obj in gc.get_objects():
     i = i + 1
     curBytes = sys.getsizeof(obj)
     sum = sum + curBytes
     print('\n\nObject #' + str(i) + ' (' + str(curBytes) + ' bytes, all 
elements by now are at ' + str(sum) + ' bytes):')
     #print obj # Informative, but unsafe: scapy may brake this by 
throwing "*** Type error bla-bla-bla...".
   print i

port = 1024
counter = 0
counter_to_print = 1
while port < 10000000:
print('\n\n\n\n                                            Packet #' + 
str(counter_to_print) + '\n\n\n')
   counter_to_print = counter_to_print + 1
   if port == 65534:
     port = 1024
   pkt_A_TCP_start1 = Ether(src="00:0c:29:1e:b4:15", 
dst="00:0c:29:1e:b4:10") / IP(version=4L, id=1000, src="10.0.0.1", 
dst="10.0.0.2") / TCP(sport=1027, dport=port, seq=0x0)
   sendp(pkt_A_TCP_start1, iface='em0', verbose=0)
   del(pkt_A_TCP_start1)
   port=port+1
   counter = counter + 1
   if counter == 10000:
     text = getoutput('top -S')
     print text
     print gc.garbage
     gc.collect()
     print gc.garbage
     test = getoutput('top -S')
     print text
     #time.sleep(10)
     counter = 0
     printAllGcObjs()
     pdb.set_trace()
<test end>

I appreciate what you are doing and have a hope that you will pay 
attention to my request!

P.S. I can't neither login, nor register to trac.secdev.org/scapy - I'd 
rather post this bug as ticket there.

--
Best regards,
Stepan Bajburtyan

stepan.bajburtyan <at> gmail.com

---------------------------------------------------------------------
To unsubscribe, send a mail to scapy.ml-unsubscribe <at> secdev.org

Documentation error in build_dissect.rst

In the file  scapy-com/scapy/doc/build_dissect.rst is the code:

        def m2i(self, pkt, x):
            if s is None:
                return None, 0
            return str2vlenq(x)[1]

"s" is undefined.

---------------------------------------------------------------------
To unsubscribe, send a mail to scapy.ml-unsubscribe <at> secdev.org

Bug: Scapy-com does not properly decode IPv6 packets when the IP version == 6

When given an IPv6 packet trace, and the following code
    a=rdpcap("ipv6.pcap")
    print hexdump(a[1])
    print a[1].show()

scapy decodes it as IPv4:

0000   60 00 00 00 00 40 3A FF  FE 80 00 00 00 00 00 00   `.... <at> :.........
0010   00 00 00 00 00 00 00 00  FF 02 00 00 00 00 00 00   ................
0020   00 00 00 00 00 00 00 01  86 00 8D 1D 40 00 00 00   ............ <at> ...
0030   00 00 00 00 00 00 00 00  01 01 00 00 00 00 00 00   ................
0040   05 01 00 00 00 00 05 DC  03 04 40 E0 00 00 03 20   .......... <at> ....
0050   00 00 01 90 00 00 00 00  20 01 04 70 1F 15 16 EA   ........ ..p....
0060   00 00 00 00 00 00 00 00                            ........
None
###[ IP ]###
  version   = 6
  ihl       = 0
  tos       = 0x00
  len       = 0
  id        = 64
  flags     = MF
  frag      = 6911
  ttl       = 254
  proto     = 128
  chksum    = 0x00
  src       = 0.0.0.0
  dst       = 0.0.0.0
  \options   \
###[ Padding ]###
     load      =
'\x00\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x86\x00\x8d\x1d <at> \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x01\x00\x00\x00\x00\x00\x00\x05\x01\x00\x00\x00\x00\x05\xdc\x03\x04 <at> \xe0\x00\x00\x03
\x00\x00\x01\x90\x00\x00\x00\x00
\x01\x04p\x1f\x15\x16\xea\x00\x00\x00\x00\x00\x00\x00\x00'
None

Clearly the version of the packet is IPv6. TCPdumnp and wireshark
decode it properly.

Workaround:
     conf.l2types.register(101, IPv6)

and the .show now prints
###[ IPv6 ]###
  version   = 6
  tc        = 0
  fl        = 0
  plen      = 64
  nh        = ICMPv6
  hlim      = 255
  src       = fe80::
  dst       = ff02::1
###[ ICMPv6 Neighbor Discovery - Router Advertisement ]###
     type      = Router Advertisement
     code      = 0
     cksum     = 0x8d1d
     chlim     = 64
     M         = 0
     O         = 0
     H         = 0
     prf       = Medium (default)
     P         = 0
     res       = 0
     routerlifetime= 0
     reachabletime= 0
     retranstimer= 0
###[ ICMPv6 Neighbor Discovery Option - Source Link-Layer Address ]###
        type      = 1
        len       = 1
        lladdr    = 00:00:00:00:00:00
###[ ICMPv6 Neighbor Discovery Option - MTU ]###
           type      = 5
           len       = 1
           res       = 0x00
           mtu       = 1500
###[ ICMPv6 Neighbor Discovery Option - Prefix Information ]###
              type      = 3
              len       = 4
              prefixlen = 64
              L         = 1
              A         = 1
              R         = 1
              res1      = 0
              validlifetime= 0x0320
              preferredlifetime= 0x0190
              res2      = 0x00
              prefix    = 2001:470:1f15:16ea::
None

---------------------------------------------------------------------
To unsubscribe, send a mail to scapy.ml-unsubscribe <at> secdev.org

Using fragment6 with layer2 commands

byte array from raw packet data

Fwd: ARP Cache Poisong

scapy SNMP decode doesn't recognize GAUGE32 ?

I'm trying to use scapy for SNMP polling.
When I decode a response containing a "GAUGE32" value...
    data = sock.recv(8192)
    rpkt = SA.SNMP(data)
I get "Unknown prefix [42]" instead of value=<GAUGE32[0]>.

Am I doing something wrong? Or is this a (known or unknown) bug in scapy?

----------  RCVD  ------------------------------------------
version    : ASN1F_enum_INTEGER   = <ASN1_INTEGER[1L]> (1)
community  : ASN1F_STRING         = <ASN1_STRING['public']> ('public')
PDU        : ASN1F_CHOICE         = <SNMPresponse  id=<ASN1_INTEGER[0L]> error=<ASN1_INTEGER[0L]>
error_index=<ASN1_INTEGER[0L]> varbindlist=[<SNMPvarbind 
oid=<ASN1_OID['vsatSb2UtSysUptime.0']> value=<ASN1_COUNTER32[1292142L]> |>, <SNMPvarbind 
oid=<ASN1_OID['vsatSb2UtSysSoftwareVersion.0']> value=<ASN1_STRING['UT_1.5.1.0.13']> |>,
<SNMPvarbind  oid=<ASN1_OID['vsatSb2UtSysHardwareVersion.0']> value=<ASN1_STRING['UT_8
P3_V2']> |>, <SNMPvarbind  oid=<ASN1_OID['vsatSb2UtSysResets.0']> value=<ASN1_COUNTER32[68L]>
|>, <SNMPvarbind  oid=<ASN1_OID['vsatSb2UtSysTerminalType.0']> value=<ASN1_COUNTER32[1L]> |>,
<SNMPvarbind  oid=<ASN1_OID['vsatSb2UtMacMsId.1']> value=<ASN1_STRING['\x00\xa0\xbc&O\xb0']>
|>, <SNMPvarbind  oid=<ASN1_OID['vsatSb2UtOduFwVer.1']>
value=<ASN1_DECODING_ERROR['B\x01\x00']{{Unknown prefix [42] for ['B\x01\x00']}}> |>] |>
(<SNMPget  |>)

###[ SNMP ]###
  version= <ASN1_INTEGER[1L]>
  community= <ASN1_STRING['public']>
  \PDU\
   |###[ SNMPresponse ]###
   |  id= <ASN1_INTEGER[0L]>
   |  error= <ASN1_INTEGER[0L]>
   |  error_index= <ASN1_INTEGER[0L]>
   |  \varbindlist\
   |   |###[ SNMPvarbind ]###
   |   |  oid= <ASN1_OID['vsatSb2UtSysUptime.0']>
   |   |  value= <ASN1_COUNTER32[1292142L]>
   |   |###[ SNMPvarbind ]###
   |   |  oid= <ASN1_OID['vsatSb2UtSysSoftwareVersion.0']>
   |   |  value= <ASN1_STRING['UT_1.5.1.0.13']>
   |   |###[ SNMPvarbind ]###
   |   |  oid= <ASN1_OID['vsatSb2UtSysHardwareVersion.0']>
   |   |  value= <ASN1_STRING['UT_8 P3_V2']>
   |   |###[ SNMPvarbind ]###
   |   |  oid= <ASN1_OID['vsatSb2UtSysResets.0']>
   |   |  value= <ASN1_COUNTER32[68L]>
   |   |###[ SNMPvarbind ]###
   |   |  oid= <ASN1_OID['vsatSb2UtSysTerminalType.0']>
   |   |  value= <ASN1_COUNTER32[1L]>
   |   |###[ SNMPvarbind ]###
   |   |  oid= <ASN1_OID['vsatSb2UtMacMsId.1']>
   |   |  value= <ASN1_STRING['\x00\xa0\xbc&O\xb0']>
   |   |###[ SNMPvarbind ]###
   |   |  oid= <ASN1_OID['vsatSb2UtOduFwVer.1']>
   |   |  value= <ASN1_DECODING_ERROR['B\x01\x00']{{Unknown prefix [42] for ['B\x01\x00']}}>

---------------------------------------------------------------------
To unsubscribe, send a mail to scapy.ml-unsubscribe <at> secdev.org

How to inject 802.11 frames on FreeBSD

Decoding IPv6/sixlowpan problem

New user problem

New scapy user here. I'm having trouble getting scapy-com to work right.
I'm trying to use it to analyse sixlowpan packets.

I did an hg clone of scapy, and installed it, then did the same for
scapy-com. I've tried it on a few machines, and I've gotten different
errors, and using different working directories, etc. Here are three
of these errors:

1) When I start scapy, I get
     ImportError: cannot import name corrupt_bits

     also - the test/import_tester fails in scapy-com

2) When I type
>>> import scapy.layers.sixlowpan
Traceback (most recent call last):
  File "<console>", line 1, in <module>
ImportError: No module named sixlowpan

3) Another error I have seen is when I type
 a=rdpcap("file.pcap")
it tells me that it doesn't understand the function rdpcap(.I

I get one of the three errors, depending on current directory, etc. I
can't find the right combination that lets me do all three without
error.
Perhaps I'm not properly setting up my PYTHONPATH variable. I tried a
few different variations, but I must be missing something.

4)  On another machine, I get rdpcap to work(finally), but it tells me
>>> a=rdpcap("endpoint-join.pcap")
WARNING: bad ihl (0). Assuming ihl=5
WARNING: bad ihl (0). Assuming ihl=5
WARNING: more bad ihl (0). Assuming ihl=5

The system I am monitoring is an engineering prototype, btw.

---------------------------------------------------------------------
To unsubscribe, send a mail to scapy.ml-unsubscribe <at> secdev.org