In this video, I'm going to show you how to use Python to capture packets off the wire.
We're going to use Python scripts so that we can programmatically run Wireshark to capture packets of
the wire and then display something in this topology.
I have an option to host an ether switch switch.
That's the built in switch in genius three, a Cisco iOS switch and a Cisco iOS router.
The router is running multiple routing protocols, so we should be able to capture OSPF messages and
IGP messages on the saboteur.
Host The switch is going to be generating multiple messages such as http, cdp, http.
So those once again should be captured by this Ubuntu host.
So again, what are we going to do is run wireshark on the ubuntu host but specifically t shock and
an application called py shock which allows us to leverage t shock and interact with t shock using python.
Now there are many ways to do this, but this is a very simple way to get started.
So again, I'm going to show you how to use Python to programmatically manipulate t shock to capture
packets and display information to us.
This net cloud gives us internet access.
So the ubuntu host is connected to the internet because I want to show you how to download applications
from the internet.
So as an example, I can ping google from the xubuntu.
Host, it received an IP address from the net cloud.
So again, ping, say google.com.
That ping succeeds because we have internet connectivity from the Ubuntu host through the switch via
the net cloud onto my physical network and onto the internet.
Okay.
So the first thing we want to do is install t shock.
Before doing that, I'm going to update ubuntu references.
It's recommended that you update your references before installing software, making sure that the references
are good, that you have the most up to date information.
So my ubuntu references have been updated, so I'm going to use the command apt get install t shock.
Now this is once again an a boon to host, so I'm going to be using a bunch of commands in this example.
I'm going to specify yes to install the software.
And that'll essentially download t shock from the internet and install it on my computer.
I'm going to allow non super users to capture packets, even though that's not exactly necessary here.
I'm running as route on the super client.
So the commands we've run are apt to get installed to shock.
And before that I used app to get update.
Now I'm using an ubuntu host here.
Python 3.5 is already installed.
You could use app to get install python and specify a python version to install.
So I could use commands such as apt get install python 3.5.
But notice I've already got Python 3.5 installed.
So I've already got Python installed.
The next thing to install is PUP three.
Now what I'm going to do is install Pip.
And in this case, I want to get Python three pip.
I'm going to be using Python three.
It's recommended today that you use Python three.
Python two is going to be end of life very soon.
So we want to use python three rather than python two and py shock runs with python three.
You have to use a legacy version of py shock if you want to use Python 2.7.
So all we're doing here once again is connecting to the Internet and installing PIP.
So again, that's the command we used.
App get install python three pip.
I'll add all these commands below this video so you can.
Follow the commands, if you like.
Okay.
POP3 is installed so now I can use the command pip three install py shock.
This will install py shock on my computer.
Supply shock is now installed.
And what I could do as an example is run te shock and notice te shock is now capturing packets.
I can see in OSPF packet I can see spanning tree.
I can see air drop and so forth.
So I've been able to successfully run t shock and capture packets.
PY Shock doesn't run here.
We're going to call py shock from within a Python script or directly from within Python.