Analyzing Packet Responses
Learn how to analyze potential responses to SYN scanning packets to determine which ports on the target system are open/closed.
Examining packet responses
In the previous lesson, we looked at sending and receiving packets in Scapy but didn’t analyze the results. In this lesson, we’ll examine the return values from the sr
function and use them to determine which ports are open or closed on the target system.
To start, let’s take another look at our SYN scanning code. Note that the TCP layer has an S
flag set, indicating that it is a SYN packet, the first packet in the TCP handshake.
from scapy.all import *ip = IP(dst='8.8.4.4')ports = [53, 80, 443]tcp = TCP(sport=7777,dport=ports,flags="S")p = ip/tcpres = sr(p,verbose=0,timeout=2)print(res)
If we run the code, we can see the results of sending the three packets to the target system ((<Results: TCP:2 UDP:0 ICMP:0 Other:0>, <Unanswered: TCP:1 UDP:0 ICMP:0 Other:0>)
). A tuple contains the set of results, which are packets sent in response to the sent packets, as well as a set of unanswered packets. These packets are further broken up into TCP and UDP packets as well ...