...

/

Analyzing Packet Responses

Analyzing Packet Responses

Learn how to analyze potential responses to SYN scanning packets to determine which ports on the target system are open/closed.

Examining packet responses

In the previous lesson, we looked at sending and receiving packets in Scapy but didn’t analyze the results. In this lesson, we’ll examine the return values from the sr function and use them to determine which ports are open or closed on the target system.

To start, let’s take another look at our SYN scanning code. Note that the TCP layer has an S flag set, indicating that it is a SYN packet, the first packet in the TCP handshake.

Press + to interact
from scapy.all import *
ip = IP(dst='8.8.4.4')
ports = [53, 80, 443]
tcp = TCP(sport=7777,dport=ports,flags="S")
p = ip/tcp
res = sr(p,verbose=0,timeout=2)
print(res)

If we run the code, we can see the results of sending the three packets to the target system ((<Results: TCP:2 UDP:0 ICMP:0 Other:0>, <Unanswered: TCP:1 UDP:0 ICMP:0 Other:0>)). A tuple contains the set of results, which are packets sent in response to the sent packets, as well as a set of unanswered packets. These packets are further broken up into TCP and UDP packets as well ...