转载请注明：@小五义：http://www.cnblogs/xiaowuyi
在安装完scapy（前两篇笔记有介绍）后，linux环境下，执行sudo scapy运行scapy。
一、简单的发送包
1、send()在第三层发送数据包，但没有接收功能。如：
>>> send(IP(dst="www.baidu.com",ttl=1)/ICMP()) . Sent 1 packets.
这里相当于ping了下百度，ttl=1
2、sendp()，在第二层发送数据包，同样没有接收功能。如：
>>> sendp(Ether()/IP(dst="www.baidu.com",ttl=1)/ICMP()) WARNING: Mac address to reach destination not found. Using broadcast. . Sent 1 packets. >>> sendp(Ether()/IP(dst="127.0.0.1",ttl=1)/ICMP()) . Sent 1 packets.
3、sr()，在第三层发送数据包，有接收功能。如：
>>> p=sr(IP(dst="www.baidu.com",ttl=1)/ICMP()) Begin emission: ..Finished to send 1 packets. .* Received 4 packets, got 1 answers, remaining 0 packets >>> p (<Results: TCP:0 UDP:0 ICMP:1 Other:0>, <Unanswered: TCP:0 UDP:0 ICMP:0 Other:0>) >>> p[0] <Results: TCP:0 UDP:0 ICMP:1 Other:0> >>> p[0].show() 0000 IP / ICMP 27.214.222.160 > 61.135.169.105 echo-request 0 ==> IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror
再比如，连续发送ttl=1,2,3,4四个包的情况
>>> p=sr(IP(dst="www.baidu.com",ttl=(1,4))/ICMP()) Begin emission: Finished to send 4 packets. .*.*.*.* Received 8 packets, got 4 answers, remaining 0 packets >>> p (<Results: TCP:0 UDP:0 ICMP:4 Other:0>, <Unanswered: TCP:0 UDP:0 ICMP:0 Other:0>) >>> p[0].show() 0000 IP / ICMP 27.214.222.160 > 61.135.169.125 echo-request 0 ==> IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror 0001 IP / ICMP 27.214.222.160 > 61.135.169.125 echo-request 0 ==> IP / ICMP 222.132.4.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror 0002 IP / ICMP 27.214.222.160 > 61.135.169.125 echo-request 0 ==> IP / ICMP 119.190.5.126 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror 0003 IP / ICMP 27.214.222.160 > 61.135.169.125 echo-request 0 ==> IP / ICMP 112.253.4.197 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror >>>
4、sr1(),在第三层发送数据包，有接收功能，但只接收第一个包。以上面的发送四个包为例：
>>> q=sr1(IP(dst="www.baidu.com",ttl=(1,4))/ICMP()) Begin emission: Finished to send 4 packets. .*.*.*.* Received 8 packets, got 4 answers, remaining 0 packets >>> q <IP version=4L ihl=5L tos=0xc0 len=56 id=4773 flags= frag=0L ttl=255 proto=icmp chksum=0xb611 src=27.214.220.1 dst=27.214.222.160 options=[] |<ICMP type=time-exceeded code=ttl-zero-during-transit chksum=0xf4ff unused=0 |<IPerror version=4L ihl=5L tos=0x0 len=28 id=1 flags= frag=0L ttl=1 proto=icmp chksum=0xd879 src=27.214.222.160 dst=61.135.169.105 options=[] |<ICMPerror type=echo-request code=0 chksum=0xf7ff id=0x0 seq=0x0 |>>>> >>> q.show() ###[ IP ]### version= 4L ihl= 5L tos= 0xc0 len= 56 id= 4773 flags= frag= 0L ttl= 255 proto= icmp chksum= 0xb611 src= 27.214.220.1 dst= 27.214.222.160 options ###[ ICMP ]### type= time-exceeded code= ttl-zero-during-transit chksum= 0xf4ff unused= 0 ###[ IP in ICMP ]### version= 4L ihl= 5L tos= 0x0 len= 28 id= 1 flags= frag= 0L ttl= 1 proto= icmp chksum= 0xd879 src= 27.214.222.160 dst= 61.135.169.105 options ###[ ICMP in ICMP ]### type= echo-request code= 0 chksum= 0xf7ff id= 0x0 seq= 0x0
5、srloop()，在第三层工作，如下：
>>> p=srloop(IP(dst="www.baidu.com",ttl=1)/ICMP()) RECV 1: IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror RECV 1: IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror RECV 1: IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror RECV 1: IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror RECV 1: IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror ^C Sent 5 packets, received 5 packets. 100.0% hits. >>> p=srloop(IP(dst="www.baidu.com",ttl=1)/ICMP(),inter=3,count=2) RECV 1: IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror RECV 1: IP / ICMP 27.214.220.1 > 27.214.222.160 time-exceeded ttl-zero-during-transit / IPerror / ICMPerror Sent 2 packets, received 2 packets. 100.0% hits.
这里第一条语句在执行时，将会不停的ping百度，第二条执行时每隔3秒ping一次，一共执行两次。inter表示间隔，count记录次数。
6、srp()、srp1()、srploop()与上面3、4、5相同，只是工作在第二层。
二、SYN扫描
SYN扫描：也叫“半开式扫描”（half-open scanning），因为它没有完成一个完整的TCP连接。这种方法向目标端口发送一个SYN分组（packet），如果目标端口返回SYN/ACK，那么可以肯定该端口处于检听状态；否则，返回的是RST/ACK。
>>> sr1(IP(dst="61.135.169.105")/TCP(dport=80,flags="S")) Begin emission: Finished to send 1 packets. .* Received 2 packets, got 1 answers, remaining 0 packets <IP version=4L ihl=5L tos=0x0 len=40 id=1 flags= frag=0L ttl=56 proto=tcp chksum=0xa168 src=61.135.169.105 dst=27.214.222.160 options=[] |<TCP sport=http dport=ftp_data seq=3516051844L ack=1 dataofs=5L reserved=0L flags=SA window=8192 chksum=0x2aef urgptr=0 |>> >>> sr1(IP(dst="61.135.169.105")/TCP(dport=81,flags="S")) Begin emission: Finished to send 1 packets. .* Received 2 packets, got 1 answers, remaining 0 packets <IP version=4L ihl=5L tos=0x0 len=56 id=31986 flags= frag=0L ttl=249 proto=icmp chksum=0xd677 src=123.125.248.102 dst=27.214.222.160 options=[] |<ICMP type=dest-unreach code=communication-prohibited chksum=0xfc8d unused=0 |<IPerror version=4L ihl=5L tos=0x0 len=40 id=1 flags= frag=0L ttl=56 proto=tcp chksum=0xa168 src=27.214.222.160 dst=61.135.169.105 options=[] |<TCPerror sport=ftp_data dport=81 seq=0 |>>>>
从结果看，当扫描百度（61.135.169.105）的80端口时，返回的包中ACK＝1或者flags=SA，说明该端口处于监听状态，当扫描81端口时，无ACK＝1,或者flags=，说明其未处于监听状态。
如果要扫描多个端口，可以使用以下语句，如扫描百度的80－83端口：
>>>sr(IP(dst="www.baidu.com")/TCP(dport=(80,83),flags="S"))
如要扫描21，80，3389等端口：
>>>sr(IP(dst="www.baidu.com")/TCP(dport=[21,80,3389],flags="S"))
简单要显示结果：
>>>ans,unans=_ >>>ans.summary(lambda(s,r):r.sprintf("%TCP.sport% %TCP.flags%")) http SA 81 RA 82 RA 83 RA
这里我在扫描80－83时，总是在不停的扫，用ctrl+C停止后，只能得到两个结果，目前没搞明白是什么原因。如下：
>>> sr(IP(dst="www.baidu.com",ttl=56)/TCP(dport=(80,83),flags="S")) Begin emission: Finished to send 4 packets. .*.*................................................................................. ^C Received 85 packets, got 2 answers, remaining 2 packets (<Results: TCP:1 UDP:0 ICMP:1 Other:0>, <Unanswered: TCP:2 UDP:0 ICMP:0 Other:0>) >>> ans,unans=_ >>> ans.summary() IP / TCP 27.214.134.124:ftp_data > 61.135.169.105:http S ==> IP / TCP 61.135.169.105:http > 27.214.134.124:ftp_data SA IP / TCP 27.214.134.124:ftp_data > 61.135.169.105:82 S ==> IP / ICMP 123.125.248.42 > 27.214.134.124 dest-unreach communication-prohibited / IPerror / TCPerror >>> ans.summary(lambda(s,r):r.sprintf("%TCP.sport% %TCP.flags%")) http SA ?? ??
三、TCP traceroute
traceroute:用来追踪出发点到目的地所经过的路径,通过Traceroute我们可以知道信息从你的计算机到互联网另一端的主机是走的什么路径。当然每次数据包由某一同样的出发点（source）到达某一同样的目的地(destination)走的路径可能会不一样，但基本上来说大部分时候所走的路由是相同的。
>>> ans,unans=sr(IP(dst="www.baidu.com",ttl=(4,25),id=RandShort())/TCP(flags=0x2)) Begin emission: ...*.*.*.*.*.*.*.*.*.*.*Finished to send 22 packets. .*.*.*.*.*.*.*.*.*.*....^C Received 48 packets, got 21 answers, remaining 1 packets >>> for snd,rcv in ans: ... print snd.ttl,rcv.src,isinstance(rcv.payload,TCP) ... 4 112.253.4.177 False 5 219.158.98.221 False 6 124.65.194.22 False 7 124.65.58.182 False 8 123.125.248.42 False 9 61.135.169.105 True 10 61.135.169.105 True 11 61.135.169.105 True 12 61.135.169.105 True 13 61.135.169.105 True 14 61.135.169.105 True 15 61.135.169.105 True 16 61.135.169.105 True 17 61.135.169.105 True 18 61.135.169.105 True 19 61.135.169.105 True 20 61.135.169.105 True 21 61.135.169.105 True 22 61.135.169.105 True 23 61.135.169.105 True 24 61.135.169.105 True