Skip to content

Instantly share code, notes, and snippets.

@ZuZuD
Last active July 28, 2018 20:24
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ZuZuD/b9a0187ae7061d20c3a3b71845afb90a to your computer and use it in GitHub Desktop.
Save ZuZuD/b9a0187ae7061d20c3a3b71845afb90a to your computer and use it in GitHub Desktop.
TCP states break down with Scappy
from scapy.all import *
import time
import random
def sendit(src=None, dst=None, dport=None):
"""
See the different status of a TCP connection
Was initially written to identify a docker-proxy bug: https://github.com/moby/moby/issues/27539
I suggest to keep a netstat running from the server side: $ watch -0.1 'netstat -laptn|grep 80'
Note: linux will send an RST because the packet is not issued from the kernel. Disable it by executing:
$ iptables -A OUTPUT -p tcp --tcp-flags RST RST -s <src_ip> -j DROP
"""
sport = random.randint(1024,65535)
ip=IP(src=src, dst=dst)
SYN=TCP(sport=sport,dport=dport,flags='S',seq=1000)
SYNACK=sr1(ip/SYN)
print("SYN/ACK sent to {}:{} using {}:{}".format(ip.dst, dport, ip.src, sport))
time.sleep(4)
# SYN-RECV server-side
ACK=TCP(sport=sport, dport=dport, flags='A', seq=SYNACK.ack + 1, ack=SYNACK.seq +1)
send(ip/ACK)
print('Sending ACK - Three-way handshake over')
time.sleep(4)
# ESTABLISHED
FIN=TCP(sport=sport, dport=dport, flags="FA", seq=SYNACK.ack, ack=SYNACK.seq + 1)
FINACK=sr1(ip/FIN)
print("Sending FIN/ACK - End of tcp connection")
time.sleep(4)
# LAST-ACK
LASTACK=TCP(sport=sport, dport=dport, flags="A", seq=FINACK.ack, ack=FINACK.seq + 1)
print("Last ACK sent - The session {}:{} establised to {}:{} is now closed".format(ip.src, sport, dst, dport))
time.sleep(4)
send(ip/LASTACK)
# connection closed
if __name__ == '__main__':
sendit(src='172.31.29.249',dst='172.31.46.210',dport=80)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment