首页 文章

在scapy中通过src mac过滤数据包

提问于
浏览
0

当我在wireshark中使用此过滤器过滤数据包时:wlan.sa == 04.b1.67.14.bd.64一切都很完美 .

但是,我正在尝试使用scapy使用以下python脚本,但它永远不会被源mac过滤:

from scapy.all import *
from datetime import datetime
import traceback
# import MySQLdb

def getAverageSSI():
    global ssiFinal
    return ssiFinal

def setParams():
    global window
    global timestamp
    global SSID
    global datetime
    global iterator1
    window = 1
    timestamp = datetime.now()
    SSID='DefaultName'
    iterator1 = 0
    global ssiArray

    ssiArray = []


def myPacketHandler(pkt) :
    global SSID
    global timestamp
    global iterator1
    global ssiArray

    try :

        if pkt.haslayer(Dot11) :

            ssiNew = -(256-ord(pkt.notdecoded[-4:-3]))

            ssiArray.append(ssiNew)

            diffT=(datetime.now()-timestamp).seconds


            if diffT>window:

                print 'With MAC dst = %s with SSI Power= %s' %(pkt.addr1, sum(ssiArray)/len(ssiArray))
                print ssiArray
                ssiArray = []

                timestamp=datetime.now()

    except Exception as e:
        print 'Exception'
        print e
        traceback.print_exc()
        sys.exit(0)


setParams()

try:
    sniff(iface="wlan1", filter="ether src 04:b1:67:14:bd:64", prn = myPacketHandler, store=0)
except Exception as e:
    print e
    print "Sniff AP1 Off"

我也尝试在嗅探中删除过滤器,并添加如下所示的if:

if pkt.addr1 == '04:b1:67:14:bd:64' : # mac xiaomi mi a1

            # SSID = pkt.info;
            ssiNew = -(256-ord(pkt.notdecoded[-4:-3]))

            ssiArray.append(ssiNew)

            diffT=(datetime.now()-timestamp).seconds


            if diffT>window:

                # query = "START TRANSACTION;"
                # queryBack=cur.execute(query)

                # query = "INSERT INTO RSSI VALUES(%d,\"AP1\",%d);"%(iterator1,ssiNew)
                # queryBack = cur.execute(query)

                print 'MAC = %s with SSI Power= %s' %(pkt.addr1, sum(ssiArray)/len(ssiArray))

                ssiArray = []
                # Conexion.commit()

                # iterator1+=1

                timestamp=datetime.now()

但它只是按目的地mac过滤 .

你知道如何通过mac正确过滤,如下面的wireshark图像? (它需要与wireshark过滤器完全相同的行为):

enter image description here

1 回答

  • 1

    你的第二种方法应该运行良好,如果你使用 addr2 而不是 addr1

    Dot11 FCS packet

    以下是它在802.11中的工作原理(是的,它真的很乱)
    How 802.11 addresses work

    此外,您应该更新到github scapy版本,它直接支持RSSI(因此您不必解析未解码的)

    RadioTap example

    https://github.com/secdev/scapy/archive/master.zip

相关问题