Crafting an HTTP Response Packet

Defining HTTP response packets

HTTP traffic is carried over TCP. As a result, an HTTP server or honeypot will need to be capable of maintaining the connection by sending SYN/ACK and ACK packets to acknowledge receipt of the client's requests.

However, the HTTP server must also respond to the client’s actual request for a web page. To do so, it needs to be able to build an HTTP response packet.

HTTP responses in Scapy

HTTP is an ASCII-based protocol, meaning that the contents of an HTTP packet are defined in human-readable text. It’s possible to build a valid response to an HTTP request packet by embedding a string of text within the payload of a TCP packet.

However, the content of the HTTP packet must be properly structured to be accepted by the client. This is easier to accomplish by using Scapy’s HTTPResponse structure as shown in the following code sample: