scapy speed

Re: scapy speed

Hi,

On Mon, 3 Sep 2007, Piotr Dula (pdula) wrote:

> Hello,
>
> I have  a question:
>
> with a standard PC computer, how fast more or less is scapy able to
> generate IP packets?

Medium fast.... ;)

It dempends wether you are only sending or also waiting for an answer, if 
you are precomputing packets or not, if you need to make an ARP resolution 
for each packet or not, etc.

The fastest way is using sendpfast() which will write a pcap file and call 
tcpreplay on it. (so, yes, scapy can be as fast as tcpreplay!)

--

-- 
Philippe Biondi <phil <at>  secdev.org>      SecDev.org
Computer Security/R&D                   http://www.secdev.org
PGP KeyID:3D9A43E2  FingerPrint:C40A772533730E39330DC0985EE8FF5F3D9A43E2

---------------------------------------------------------------------
Desinscription: envoyez un message a: scapy.ml-unsubscribe <at> secdev.org
Pour obtenir de l'aide, ecrivez a: scapy.ml-help <at> secdev.org

sendpfast()

Re: sendpfast()

Piotr Dula (pdula) wrote:
> PS2. Any website with detailed scapy manual? I haven't found much on
> this topic and I am using it for the first time.. :(

Have a look at http://www.secdev.org/projects/scapy/
in the "Help, documentation" section:

http://www.secdev.org/projects/scapy/demo.html (for starters)
http://www.oreilly.com/catalog/9780596009632/ (chapters 6 and 18)
http://www.secdev.org/projects/scapy/files/scapydoc.pdf (still a draft)
http://hackaholic.org/papers/blackmagic.txt (from 2005)

Philippes's slides from the various conferences are quite helpful, too.

And there are some more examples on Scapy's Trac (which seems to be down 
at the moment).
http://trac.secdev.org/scapy

For specifc problems you could also search the mailing list archives:
http://news.gmane.org/gmane.comp.security.scapy.general

Regards
Dirk

---------------------------------------------------------------------
Desinscription: envoyez un message a: scapy.ml-unsubscribe <at> secdev.org
Pour obtenir de l'aide, ecrivez a: scapy.ml-help <at> secdev.org

Re: sendpfast()

Piotr Dula (pdula) wrote:
> However, when I try to use sendpfast(a, pps=1000), it does not send
> anything despite the fact that I don't get any error message...(I'm
> running wireshark at the destination).

I haven't used sendpfast() myself, but here are two ideas (just guessing):

- Make sure you have tcpreplay (http://tcpreplay.synfin.net/) installed.
You can Scapy where to find it by setting the "conf.prog.tcpreplay" 
variable.

- sendpfast() works on Layer2, so first try if srp(a) works.

Regards
Dirk

---------------------------------------------------------------------
Desinscription: envoyez un message a: scapy.ml-unsubscribe <at> secdev.org
Pour obtenir de l'aide, ecrivez a: scapy.ml-help <at> secdev.org

RE: sendpfast()

A question connected to the one about sendpfast():

       srp(a) doesn't work but sr(a) works fine. What may be the reason
that scapy doesn't send on level 2? At least wireshark on the other end
doesn't see them..

Thank you in advance,
Piotr

---------------------------------------------------------------------
Desinscription: envoyez un message a: scapy.ml-unsubscribe <at> secdev.org
Pour obtenir de l'aide, ecrivez a: scapy.ml-help <at> secdev.org

RE: sendpfast()

On Tue, 4 Sep 2007, Piotr Dula (pdula) wrote:

> A question connected to the one about sendpfast():
>
>       srp(a) doesn't work but sr(a) works fine. What may be the reason
> that scapy doesn't send on level 2? At least wireshark on the other end
> doesn't see them..

sendpfast() works like sendp() i.e. at level 2 (and needs tcpreplay to be 
installed). sendp() is not the same as srp(). "srp" means send *and* 
receive at level 2. But when using sendp() or sendpfast() scapy will only 
send packets. Thus you cannot replace one by another like that (except for 
sendp() and sendpfast()).

Now about the level 2 vs level 3: scapy always works at level 2. When you 
use sendp(), sendpfast(), srp(), srploop(), etc., it means that you also 
work at level 2, so scapy has nothing to do except writing on the wire 
what you provided. When you use send(), sr(), srloop(), etc., it means 
that you are working at level 3, so Scapy must manage the link layer for 
you.

--

-- 
Philippe Biondi <phil <at>  secdev.org>      SecDev.org
Computer Security/R&D                   http://www.secdev.org
PGP KeyID:3D9A43E2  FingerPrint:C40A772533730E39330DC0985EE8FF5F3D9A43E2

---------------------------------------------------------------------
Desinscription: envoyez un message a: scapy.ml-unsubscribe <at> secdev.org
Pour obtenir de l'aide, ecrivez a: scapy.ml-help <at> secdev.org

sendpfast() srp() not working

srp() not working

Re: srp() not working