1

OBJECTIVE

I want to iterate through the Dot11Elt layers of a beacon frame that I captured with Scapy. I also want to decode the .info of each ID layer.

def packet_handler(packet) :

    if packet.haslayer(Dot11) :
        if packet.subtype == 8 :
            for i in packet.getlayer(Dot11Elt) :
                print i.info

def main() :

    sniff(count = 50, prn = packet_handler)

if __name__ == "__main__" :
    main()

RESULTS

This is only giving me the info of ID = 0 which is the SSID

I want to be able to iterate through the layers to get to ID = 1 , ID = 3 and so forth.

Also, I have no idea what this type of encoding it is that I get when I print

  • packet.getlayer(Dot11Elt)
  • packet(Dot11Elt)

enter image description here

1

Here you go buddy. you can have whatever you want

 from netaddr.core import NotRegisteredError
 from netaddr import *
 from scapy.all import *
 import logging  
 import logging.handlers

 PROBE_REQUEST_TYPE=0
 PROBE_REQUEST_SUBTYPE=4

 WHITELIST =   ['18:dc:56:f0:40:40','34:a3:95:b1:2b:d9','48:13:7e:57:ae:b6','98:0c:a5:17:7d:2d'] 
 my_logger = logging.getLogger('agentlogger')
 handler = logging.handlers.RotatingFileHandler('tplink3022.log',    mode='a', maxBytes=1048576, backupCount=10, encoding=None, delay=0)
my_logger.addHandler(handler)

def PacketHandler(pkt):
if pkt.haslayer(Dot11):

    if pkt.type==PROBE_REQUEST_TYPE and pkt.subtype ==      PROBE_REQUEST_SUBTYPE:
        PrintPacket(pkt)
def mac_info(mac):
    global macf
    maco = EUI(mac)
    try:
        macf = maco.oui.registration().org
    except NotRegisteredError:
        macf = "Not available"
    return macf
def PrintPacket(pkt):
    print "Probe Request Captured:"
    try:
        extra = pkt.notdecoded
    except:
        extra = None
    if extra!=None:
        signal_strength = -(256-ord(extra[-4:-3]))
    else:
        signal_strength = -100
        print "No signal strength found"    
    mac_info(pkt.addr2)
    print "Time: %s   Source: %s SSID: %s MANF: %s RSSi: %d"%(pkt.time,pkt.addr2,pkt.getlayer(Dot11ProbeReq).info,macf,signal_strength)

    str = "%s,%s,%s,%s,%d\n"%(pkt.time,pkt.addr2,pkt.getlayer(Dot11ProbeReq).info,macf,signal_strength)
WriteToFile(str)

def WriteToFile(str):
    my_logger.warn(str)

def main():
    from datetime import datetime
    print "[%s] Starting scan"%datetime.now()
    print "Scanning :"
    try:
        sniff(iface=sys.argv[1],prn=PacketHandler,count=0,store=0)
    except:
          print'[!] Eroor : Failed to initialize sniffing'    


if __name__=="__main__":
    main()`
  • 2
    I don't know if it answers the question, but for sure the indentation is broken. – techraf Feb 1 '17 at 10:19
1

Given the info in https://stackoverflow.com/a/29989032, you need to iterate over them like this:

dot11elt = packet.getlayer(Dot11Elt)
while dot11elt:
     print dot11elt.ID, dot11elt.info
     dot11elt = dot11elt.payload.getlayer(Dot11Elt)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.