Now that I've got tea shock and shock installed, I could run t shock directly and capture packets.
But that's not actually what we want to do.
But notice here we sing in real time that we are able to capture spending free packets.
He has ERP, he has OSPF, so I am actually capturing packets of the network.
But what I want to do is capture packets and write that to a file.
So I'm going to write that to this.
Pcap file t shock one pcap.
Now I want to leave this for a while so that packets are captured.
But to generate additional traffic, what I can do on my router, for example, is ping some addresses.
So I could ping as an example one, two, one, six, eight and 122.
And what I'll do here is ping the broadcast address to 55 and those packets will be captured.
I could ping a multicast address as an example and those packets will be captured.
So.
Various packets are being captured by the tea shock application on the Ubuntu PC.
I could as an example reset my OSPF process to generate some OSPF updates.
But I mean, we've captured about 60 packets already, so what I'll do is stop that capture.
So now that I've got my t shock pcap file on my local directory.
So.
Notice I've got that file on my counter host now that I've captured packets off the network.
I can open that up with py shock.
Now, in the first example, I'm going to show you commands directly from within Python three and then
I'll create a script.
So for the moment, I just want to show you the commands and the first thing I'm going to do is import
py shock and then I'm going to say cap, this could be any name.
This is just a variable py shock file capture and the file I want to capture is t shock one pcap that's
the Wireshark capture file.
Cap shows me the file that I'm using and now I can do all kinds of things.
Now remember, this is from within Python.
So if I want to look at the first packet, there you go.
Notice we captured a spanning tree packet again.
This is running within Python.
I can see the length of the packet.
I can see the Ethernet header so I'll make this bigger source.
Mac address destination MAC Address.
I can see that this is a spanning tree BPU.
I can see who the root is.
Notice there's root identifier priority mac address.
So root bridge priority is this.
For delays this hollow time is this route bridge system ID is this bridge priority is this so forth
and so on.
I could look at packet one as an example.
This is an IGP packet, so layer two Ethernet header source MAC Address Destination Mac address.
This is the multicast MAC address at layer two for IP version four, notice ten.
That's the multicast address used for EGP.
Ether top is IPv4.
So at layer three, we have an IP header.
IP version for DHCP is set to six.
Very important traffic source IP addresses.
This protocol number is 88 IGP.
So notice at the higher layers we have IGP, we can see the K values.
Now this output is all over the place but notice
k1k2k3k4k5k6.
We can see software version.
We can see the autonomous system number 100.
If we have a look at packet two, we can see that this is a.
Spending tree update once again.
So spending tree.
What about cap three?
Spending tree cap for the size ii gop again five spending tree six OSPF.
So six is OSPF layer two header layer three header notice protocol number is 89.
Here's OSPF.
Now please remember this is running within Python.
I'm showing you some basics now, but later on I'll show you how to script stuff.
So as an example, if we looked at packet one and we use the show option, so print and I don't actually
need to use print from within Python, I can just do it this way.
So cap one show.
And I actually want to do it this way.
Notice here's my job packet in pretty format.
So Ethernet header.
IP header.
Yeah.
GOP.
Let's look at six.
Six is OSPF, if I remember correctly.
Yes, it is.
So here's our OSPF output again.
This is all being used from within.
Python.
I'm running this output in Python.
Now you might say, okay, but this doesn't really help me notice.
What you could do is I could say, okay, print.
Kept one, which was.
JP, if I remember right.
IP Notice this is the IP header or I could say only show me the IGP information.
So once again, this is everything.
Make some spaces yet.
So this is everything.
Notice.
Print cap one.
This is everything.
But what I could do is just look at the IP header or just look at the IGP header or taking this a step
further, look at the autonomous system number and that should be an S.
So A is number, A is number is 100.
So rather than trying to dig through the information, this makes it much easier.
This this application pie shop allows me to look at specific details.
I could, as an example, look at the parameter k one what's k one said to its 1k2 set to 0k3 set to
1k4 set to zero.
K five is zero six is zero.
The moral of the story is I can burrow into the CAPTCHA and get information and then store that in a
variable.
So I could say II job as equals that.
And.
Let's get rid of the bracket.
So if I just look at Egpus, that's what it is, and then I could do something with that in my programming.
Commands such as do our work here so I could look at a specific package.
Let's look at the air.
Drop one again and I can see all kinds of options available for that packet.
So I could, as an example, print IP.
And I'm doing that wrong.
It should be IP like this.
So there's the IP header once again.
So let's do that draw again.
So a lot of options are available.
In this application.
Notice, looking at layers, we've got an Ethernet layer, IP layer and IP layer.
We can look at the Ethernet header, so just look at EITH, there's our Ethernet header, we can see
source MAC address, destination, MAC address, a lot of options available here.
Okay.
So that was basic python.
Let's see if we can create a script, however, rather than.
Doing it directly live coding in Python.
Now I have seen this error come up.
Now StackOverflow is a great place to go and look for help if you're having problems with programming.
Someone else has had this problem as well where this message displays.
So notice as an example, they're having these errors very similar to me.
Over here.
And the answer is to upgrade the versions of of software.
This was actually a bug in one of the versions of software.
Now, I'm not going to worry too much about that because it doesn't really affect what we're doing here.
So I'm going to clear the screen.
And what I'm going to do now is create a Python script.