My question is: Can I sniff the mirrored packets as if I am accepting python socket?
I am receiving a file on Server A by using get_file_by_socket.py :
import socket
import tqdm
import os
import hashlib
import time
SERVER_HOST = "192.168.1.1"
SERVER_PORT = 5201
counter = 1
BUFFER_SIZE = 4096
SEPARATOR = "<SEPARATOR>"
s = socket.socket()
s.bind((SERVER_HOST, SERVER_PORT))
s.listen(5)
print(f"[*] Listening as {SERVER_HOST}:{SERVER_PORT}")
client_socket, address = s.accept()
print("client_scoket = ",client_socket,address)
print(f"[+] {address} is connected")
received = client_socket.recv(BUFFER_SIZE).decode()
filename,filesize = received.split(SEPARATOR)
filename = os.path.basename(filename)
filesize = int(filesize)
file_hash = hashlib.md5()
progress = tqdm.tqdm(range(filesize), f"Receiving {filename}", unit="B",unit_scale=True, unit_divisor=1024)
with open(filename,"wb") as f:
while True:
bytes_read = client_socket.recv(BUFFER_SIZE)
if not bytes_read:
break
f.write(bytes_read)
file_hash.update(bytes_read)
print(f"{counter}. Bytes_read={bytes_read}")
#print(f"{counter}. ")
counter = counter + 1
time.sleep(0.001)
progress.update(len(bytes_read))
client_socket.close()
s.close()
I am sending the file using send_file_by_socket.py from Host B :
import socket
import tqdm
import os
import sys
SEPARATOR = "<SEPARATOR>"
BUFFER_SIZE = 4096
host = sys.argv[1] #"192.168.1.1"
print("host=",host)
port = 5201
filename = sys.argv[2] #"twibot20.json"
print("filename=",filename)
filesize = os.path.getsize(filename)
s = socket.socket()
#s.setsockopt(socket.SOL_SOCKET,25,'enp2s0')
print(f"[+] Connecting to {host}:{port}")
s.connect((host,port))
print("[+] Connected.")
s.send(f"{filename}{SEPARATOR}{filesize}".encode())
progress = tqdm.tqdm(range(filesize), f"Sending {filename}", unit="B", unit_scale = True, unit_divisor=1024)
with open(filename, "rb") as f:
while True :
bytes_read = f.read(BUFFER_SIZE)
if not bytes_read:
break
s.sendall(bytes_read)
progress.update(len(bytes_read))
s.close()
The sender sends the file and the server receives it successfully. The transfer rate around 2.3Gb/s. Now I am mirroring the packets while the transfer is happening. I sniff the packets using sniff_mirrored_packets.py :
def get_if():
ifs=get_if_list()
iface=None
for i in get_if_list():
if "enp1s0f1" in i:
iface=i
break;
if not iface:
print("Cannot find eth0 interface")
exit(1)
return iface
def handle_pkt(pkt):
global file_hash
global counter
try :
setir = pkt[IP].load
except :
setir = ""
if "<SEPARATOR>" in str(setir):
setir = ""
if setir!="" :
file_hash.update(setir)
print("{}. Hash = {} ".format(counter,file_hash.hexdigest()))
#pkt.show2()
sys.stdout.flush()
counter = counter +1
def main():
ifaces = [i for i in os.listdir('/sys/class/net/') ]
iface = get_if()
print(("sniffing on %s" % iface))
sys.stdout.flush()
sniff(filter='tcp and port 5201',iface = iface,
prn = lambda x: handle_pkt(x))
if __name__ == '__main__':
main()
The problem is socket transfer rate is too high, that’s why I included :
time.sleep(0.001)
on get_file_by_socket.py on the server-side, since sniffing speed on the mirror side is too slow. When I send a 3MB file from Host B, I get around 200 out of 1000 packets in the mirror-side using the tshark. When I time.sleep(0.001) on the server-side, only then I do receive all 1000 packets on the mirror-side.
My questions are:
- How do I get transfer data from mirrored port without establishing TCP/IP handshake python socket? Can I get the mirrored packets the same as on get_file_by_socket.py by ignoring TCP handshake which is happening between Host B and Server A. (I implemented get_file_by_socket.py like code on the mirror-side but it stuck in handshake because the mirrored packets don’t have any handshake in it). The sniffing method that I am using is too slow in comparison with socket transfer rate.
- What other methods can be used to catch up with the socket transfer rate?
. Still, I think this question could also be related to telemetry (INT) to some extent so let me try to answer you considering I might not have the best answer for them: