pythonpython-3.xscapyarpkali-linux

Network Scanner build using Scapy only scans itself


Below is the code of NetworkScanner that I tried to build as my first Python project. #!/usr/bin/env python

import scapy.all as scapy
import optparse


def scan(ip):
    packet1 = scapy.ARP(pdst=ip)
    etherpacket = scapy.Ether(dst='ff:ff:ff:ff:ff:ff')
    broadcast_packet = etherpacket / packet1
    ans = scapy.srp(broadcast_packet, timeout=60, verbose=False)[0]
    ret_list = list()

    for item in ans:
        dic = {}
        dic['ip'] = item[1].pdst
        dic['mac'] = item[1].hwdst
        ret_list.append(dic)
    print(ret_list)
    return ret_list


def printfun(returnlist):
    print("IP\t\t\tMAC Address\n----------------------------------------------")
    for elem in returnlist:
        print(elem["ip"] + "\t\t" + elem["mac"])


def getip():

    parser = optparse.OptionParser()
    parser.add_option('-i', "--ip", dest = 'received_ip', help="Please enter the ip you want to scan")
    (option, arguments) = parser.parse_args()
    return option.received_ip


ip = getip()
if ip:
    result = scan(ip)
    printfun(result)
else:
    print("no ip given")

Now I did follow some tutorials and learned to build parallelly and it seems right to me but I am not good. but when I execute the program, it only scans the IP of virtual Host itself on which it is executed.

/PycharmProjects/Networkscanner$ sudo python networkscanner.py -i 192.168.1.1/24
[{'ip': '192.168.1.205', 'mac': '08:00:27:1f:30:76'}, {'ip': '192.168.1.205', 'mac': '08:00:27:1f:30:76'}]
IP          MAC Address
----------------------------------------------
192.168.1.205       08:00:27:1f:30:76
192.168.1.205       08:00:27:1f:30:76

when I use the inbuild network scanner of python it gives these results.

 Currently scanning: Finished!   |   Screen View: Unique Hosts                 

 5 Captured ARP Req/Rep packets, from 4 hosts.   Total size: 300               
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.1.1     a0:47:d7:36:2a:c0      2     120  Best IT World (India) Pvt Lt
 192.168.1.203   e4:42:a6:30:93:64      1      60  Intel Corporate             
 192.168.1.205   30:b5:c2:10:05:3b      1      60  TP-LINK TECHNOLOGIES CO.,LTD
 192.168.1.207   30:b5:c2:10:05:3b      1      60  TP-LINK TECHNOLOGIES CO.,LTD

Edit: I tried the Monitor mode, but that does not help. I also tried to run it on main windows with also an external WiFi adaptor, still same issue

can someone please assist what is wrong in my code?


Solution

  • Determining the problem

    If we name variables more appropriately, it becomes apparent what the problem is:

    for sent_recv in ans:
        dic = {}
        return_packet = sent_recv[1]
        dic['ip'] = return_packet.pdst
        dic['mac'] = return_packet.hwdst
        ret_list.append(dic)
    

    So if we change it to the src IP/MAC of the returning packet, we'll get the information we're after:

    for sent_recv in ans:
        dic = {}
        return_packet = sent_recv[1]
        # Difference is dst => src here
        dic['ip'] = return_packet.psrc
        dic['mac'] = return_packet.hwsrc
        ret_list.append(dic)
    

    Note: An ARP packet should not take 60s to return - it's more on the scale of 10-100ms depending on network size. A timeout of 2s is more appropriate here.

    Testing the fix

    Running this with modified code, we get the desired result:

    $ python script.py -i "192.168.1.0/24"
    [{'ip': '192.168.1.48', 'mac': '00:1b:78:20:ee:40'}, 
     {'ip': '192.168.1.67', 'mac': '6c:33:a9:42:6a:18'}, 
    ...
    
    IP          MAC Address
    ----------------------------------------------
    192.168.1.48        00:1b:78:20:ee:40
    192.168.1.67        6c:33:a9:42:6a:18
    ...