Scapy - how to check packet type of sniffed packets

5
votes

I am sniffing packets and need to know which packets are ICMPv6 Echo Request packets and which are UDP packets.

I know that I can do

P = sniff(filter='ip6 and host fe80::xx:xx:xx:xx',count=0)

IP in P  #will return false (my packets are IPv6)
UDP in P #will return true (when the specific packet is indeed UDP)

but I don't know how to check for ICMPv6 packets, and even more specifically ICMPv6 Echo Request packets... It doesn't seem like I can even check for anything IP version 6:

IPv6, IP6, ipv6, ip6, icmpv6, ICMPv6, icmp6, ICMP6 all return a 

NameError: name 'x' is not defined

Does anyone know of a way to do such a thing?

1
pythonscapysniffing
What version of scapy do you have? Running scapy 2.1.0 (on Python 2.7.2 on OS X 10.8.5), IPv6 in P works fine for me. – abarnert
In particular, after making sure I captured exactly one UDP v6 packet: UDP in P is False, UDP in P[0] is True, IPv6 in P is False, IPv6 in P is True, P[0][IPv6] is an IPv6 packet, … – abarnert

1 Answers

5
votes

If you're using Scapy v1.x, it does not handle IPv6, as it says in various places in the documentation. For example, in Download and Installation:

Scapy v2.x. The current development version adds several features (e.g. IPv6).

If you're using 2.x, it should work just fine with IPv6. For example, on my computer (Scapy 2.1.0, Apple pre-installed Python 2.7.2, OS X 10.8.5):

>>> P = sniff(filter='ip6', count=0)
… make sure to capture an IPv6 UDP packet …
>>> UDP in P
False
>>> IPv6 in P
False
>>> UDP in P[0]
True
>>> IPv6 in P[0]
True
>>> P[0][IPv6]
<IPv6  version=6L tc=0L fl=0L plen=98 nh=UDP …
>>> ICMPv6EchoRequest in P[0]
False
>>> ICMPv6EchoRequest
<class 'scapy.layers.inet6.ICMPv6EchoRequest'>