difference between `sr()` and `sniff()` scapy

Question

i want to know the difference between sr() and sniff() i will clear myself: when i send packets with sr() and then print the answer, it's giving me just one packet:

Received 1 packets, got 1 answers, remaining 0 packets
[(<IP  frag=0 ttl=64 proto=tcp dst=216.58.210.4 |<TCP  sport=37945 dport=http seq=1 ack=1477254816 flags=A |<Raw  load='GET /index.html HTTP/1.0 \n\n' |>>>, <IP  version=4L ihl=5L tos=0x0 len=40 id=1338 flags= frag=0L ttl=128 proto=tcp chksum=0xe12d src=216.58.210.4 dst=192.168.233.128 options=[] |<TCP  sport=http dport=37945 seq=1477254816 ack=28 dataofs=5L reserved=0L flags=A window=64240 chksum=0x5528 urgptr=0 |<Padding  load='\x00\x00\x00\x00\x00\x00' |>>>)]

but when i do the same with sniff i got alot more packets, and one of them its the packet with the answer i asked:

<Ether  dst=00:0c:29:bb:8e:79 src=00:50:56:e9:b8:b1 type=0x800 |<IP  version=4L ihl=5L tos=0x0 len=537 id=1339 flags= frag=0L ttl=128 proto=tcp chksum=0xdf3b src=216.58.210.4 dst=192.168.233.128 options=[] |<TCP  sport=http dport=37945 seq=1477254816 ack=28 dataofs=5L reserved=0L flags=PA window=64240 chksum=0x98df urgptr=0 options=[] |<Raw  load='HTTP/1.0 302 Found\r\nCache-Control: private\r\nContent-Type: text/html; charset=UTF-8\r\nLocation: http://www.google.co.il/index.html?gfe_rd=cr&ei=_geSV8u1C6Xb8AeaxJCoDQ\r\nContent-Length: 271\r\nDate: Fri, 22 Jul 2016 11:48:14 GMT\r\n\r\n<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">\n<TITLE>302 Moved</TITLE></HEAD><BODY>\n<H1>302 Moved</H1>\nThe document has moved\n<A HREF="http://www.google.co.il/index.html?gfe_rd=cr&amp;ei=_geSV8u1C6Xb8AeaxJCoDQ">here</A>.\r\n</BODY></HTML>\r\n' |>>>>

if you will see - the second packet have the html code i asked for (that was with sniffing it.) but wht first not have this.

Vihasith Vihasith · Accepted Answer · 2018-10-15T22:12:08

You can use the lsc() in scapy bash to check out all the required commands and their usage.

sr : Send and receive packets at layer 3

sr1 : Send packets at layer 3 and return only the first answer

srp : Send and receive packets at layer 2

srp1 : Send and receive packets at layer 2 and return only the first answer

srloop : Send a packet at layer 3 in loop and print the answer each time

srploop : Send a packet at layer 2 in loop and print the answer each time

sniff : Sniff packets

send : Send packets at layer 3

sendp : Send packets at layer 2

You can use the sniff(iface ="your interface", filter = "dst aa:bb:cc:dd:ee") to get the packets that you want. The sniff function has lots of parameters to shortlist the packets.

difference between `sr()` and `sniff()` scapy

2 Answers