My first scapied IPv6 packet

The idea of this lab is to craft an IPv6 packet from scratch using Python and Scapy library.

The IDE I use is JetBrains PyCharm Community Edition 2018.3.1 x64 which is available for free at : https://www.jetbrains.com/pycharm/download/download-thanks.html?platform=windows&code=PCC

The IDE interface looks like in figure:

You’ll need to add Scapy library in Project Interpreter section (File->Settings):

In my lab setup I use GN3 Version 2.1.11 x64 with Python 3.6.6 Qt 5.9.1 and PyQt 5.9.

R1 connects to real world (PC-2, my workstation running Windows 7 Professional SP1) through Switch-1. PC-2 “test” interface is a VirtualBox Host-Only Ethernet Adapter.

R1, R2 and R3 interfaces are in OSPF domain area 0.

We check that routing is working and PC-1 can ping PC-2:

R1#sh ipv route ospf
IPv6 Routing Table - default - 7 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
IS - ISIS summary, D - EIGRP, EX - EIGRP external, ND - ND Default
NDp - ND Prefix, DCE - Destination, NDr - Redirect, O - OSPF Intra
OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2, ON1 - OSPF NSSA ext 1
ON2 - OSPF NSSA ext 2
O 2001:3::/126 [110/2]
via FE80::C802:7FF:FEC4:1C, FastEthernet1/0
O 2001:4::/126 [110/3]
via FE80::C802:7FF:FEC4:1C, FastEthernet1/0
R1#

R3#sh ipv route ospf
IPv6 Routing Table - default - 8 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
IS - ISIS summary, D - EIGRP, EX - EIGRP external, ND - ND Default
NDp - ND Prefix, DCE - Destination, NDr - Redirect, O - OSPF Intra
OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2, ON1 - OSPF NSSA ext 1
ON2 - OSPF NSSA ext 2
O 2001:1::/126 [110/3]
via FE80::C802:7FF:FEC4:1D, FastEthernet1/1
O 2001:2::/126 [110/2]
via FE80::C802:7FF:FEC4:1D, FastEthernet1/1
R3#

PC-1> ping 2001:1::1

2001:1::1 icmp6_seq=1 ttl=61 time=40.002 ms
2001:1::1 icmp6_seq=2 ttl=61 time=38.002 ms
2001:1::1 icmp6_seq=3 ttl=61 time=39.002 ms
2001:1::1 icmp6_seq=4 ttl=61 time=39.003 ms
2001:1::1 icmp6_seq=5 ttl=61 time=40.002 ms

PC-1>

A wireshark capture shows the detail of the echo request as it is sent by PC-1:

Frame 3: 118 bytes on wire (944 bits), 118 bytes captured (944 bits) on interface 0
Interface id: 0 (-)
Interface name: -
Encapsulation type: Ethernet (1)
Arrival Time: Dec 21, 2018 13:53:44.166908000 Paris, Madrid
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1545396824.166908000 seconds
[Time delta from previous captured frame: 6.907395000 seconds]
[Time delta from previous displayed frame: 6.907395000 seconds]
[Time since reference or first frame: 16.181925000 seconds]
Frame Number: 3
Frame Length: 118 bytes (944 bits)
Capture Length: 118 bytes (944 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ipv6:icmpv6:data]
[Coloring Rule Name: ICMP]
[Coloring Rule String: icmp || icmpv6]

Ethernet II, Src: Private_66:68:00 (00:50:79:66:68:00), Dst: ca:03:0c:6c:00:00 (ca:03:0c:6c:00:00)
Destination: ca:03:0c:6c:00:00 (ca:03:0c:6c:00:00)
Address: ca:03:0c:6c:00:00 (ca:03:0c:6c:00:00)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: Private_66:68:00 (00:50:79:66:68:00)
Address: Private_66:68:00 (00:50:79:66:68:00)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv6 (0x86dd)

Internet Protocol Version 6, Src: 2001:4::1, Dst: 2001:1::1
0110 .... = Version: 6
.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
.... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
.... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
.... .... .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
Payload Length: 64
Next Header: ICMPv6 (58)
Hop Limit: 64
Source: 2001:4::1
Destination: 2001:1::1

Internet Control Message Protocol v6
Type: Echo (ping) request (128)
Code: 0
Checksum: 0xef85 [correct]
[Checksum Status: Good]
Identifier: 0x58e2
Sequence: 1
[Response In: 6]
Data (56 bytes)
Data: 000102030405060708090a0b0c0d0e0f1011121314151617...
[Length: 56]

The same packet that is seen by PC-2:

Frame 2: 118 bytes on wire (944 bits), 118 bytes captured (944 bits) on interface 0
Interface id: 0 (-)
Interface name: -
Encapsulation type: Ethernet (1)
Arrival Time: Dec 21, 2018 14:02:16.750226000 Paris, Madrid
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1545397336.750226000 seconds
[Time delta from previous captured frame: 7.890451000 seconds]
[Time delta from previous displayed frame: 7.890451000 seconds]
[Time since reference or first frame: 7.890451000 seconds]
Frame Number: 2
Frame Length: 118 bytes (944 bits)
Capture Length: 118 bytes (944 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ipv6:icmpv6:data]
[Coloring Rule Name: ICMP]
[Coloring Rule String: icmp || icmpv6]

Ethernet II, Src: ca:01:1f:08:00:00 (ca:01:1f:08:00:00), Dst: 0a:00:27:00:00:1c (0a:00:27:00:00:1c)
Destination: 0a:00:27:00:00:1c (0a:00:27:00:00:1c)
Address: 0a:00:27:00:00:1c (0a:00:27:00:00:1c)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: ca:01:1f:08:00:00 (ca:01:1f:08:00:00)
Address: ca:01:1f:08:00:00 (ca:01:1f:08:00:00)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv6 (0x86dd)

Internet Protocol Version 6, Src: 2001:4::1, Dst: 2001:1::1
0110 .... = Version: 6
.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
.... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
.... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
.... .... .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
Payload Length: 64
Next Header: ICMPv6 (58)
Hop Limit: 61
Source: 2001:4::1
Destination: 2001:1::1
Internet Control Message Protocol v6
Type: Echo (ping) request (128)
Code: 0
Checksum: 0xef83 [correct]
[Checksum Status: Good]
Identifier: 0x58e4
Sequence: 1
[Response In: 5]
Data (56 bytes)
Data: 000102030405060708090a0b0c0d0e0f1011121314151617...
[Length: 56]

The detailed packet echo response that is seen by PC-1:

Frame 6: 118 bytes on wire (944 bits), 118 bytes captured (944 bits) on interface 0
Interface id: 0 (-)
Interface name: -
Encapsulation type: Ethernet (1)
Arrival Time: Dec 21, 2018 13:53:44.249913000 Paris, Madrid
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1545396824.249913000 seconds
[Time delta from previous captured frame: 0.010001000 seconds]
[Time delta from previous displayed frame: 0.010001000 seconds]
[Time since reference or first frame: 16.264930000 seconds]
Frame Number: 6
Frame Length: 118 bytes (944 bits)
Capture Length: 118 bytes (944 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ipv6:icmpv6:data]
[Coloring Rule Name: ICMP]
[Coloring Rule String: icmp || icmpv6]

Ethernet II, Src: ca:03:0c:6c:00:00 (ca:03:0c:6c:00:00), Dst: Private_66:68:00 (00:50:79:66:68:00)
Destination: Private_66:68:00 (00:50:79:66:68:00)
Address: Private_66:68:00 (00:50:79:66:68:00)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: ca:03:0c:6c:00:00 (ca:03:0c:6c:00:00)
Address: ca:03:0c:6c:00:00 (ca:03:0c:6c:00:00)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv6 (0x86dd)

Internet Protocol Version 6, Src: 2001:1::1, Dst: 2001:4::1
0110 .... = Version: 6
.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
.... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
.... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
.... .... .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
Payload Length: 64
Next Header: ICMPv6 (58)
Hop Limit: 61
Source: 2001:1::1
Destination: 2001:4::1
Internet Control Message Protocol v6
Type: Echo (ping) reply (129)
Code: 0
Checksum: 0xee85 [correct]
[Checksum Status: Good]
Identifier: 0x58e2
Sequence: 1
[Response To: 3]
[Response Time: 83.005 ms]
Data (56 bytes)
Data: 000102030405060708090a0b0c0d0e0f1011121314151617...
[Length: 56]

The detailed packet echo response that is sent by PC-2:

Frame 5: 118 bytes on wire (944 bits), 118 bytes captured (944 bits) on interface 0
Interface id: 0 (-)
Interface name: -
Encapsulation type: Ethernet (1)
Arrival Time: Dec 21, 2018 14:02:16.780228000 Paris, Madrid
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1545397336.780228000 seconds
[Time delta from previous captured frame: 0.001000000 seconds]
[Time delta from previous displayed frame: 0.001000000 seconds]
[Time since reference or first frame: 7.920453000 seconds]
Frame Number: 5
Frame Length: 118 bytes (944 bits)
Capture Length: 118 bytes (944 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ipv6:icmpv6:data]
[Coloring Rule Name: ICMP]
[Coloring Rule String: icmp || icmpv6]

Ethernet II, Src: 0a:00:27:00:00:1c (0a:00:27:00:00:1c), Dst: ca:01:1f:08:00:00 (ca:01:1f:08:00:00)
Destination: ca:01:1f:08:00:00 (ca:01:1f:08:00:00)
Address: ca:01:1f:08:00:00 (ca:01:1f:08:00:00)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: 0a:00:27:00:00:1c (0a:00:27:00:00:1c)
Address: 0a:00:27:00:00:1c (0a:00:27:00:00:1c)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv6 (0x86dd)

Internet Protocol Version 6, Src: 2001:1::1, Dst: 2001:4::1
0110 .... = Version: 6
.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
.... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
.... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
.... .... .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
Payload Length: 64
Next Header: ICMPv6 (58)
Hop Limit: 64
Source: 2001:1::1
Destination: 2001:4::1
Internet Control Message Protocol v6
Type: Echo (ping) reply (129)
Code: 0
Checksum: 0xee83 [correct]
[Checksum Status: Good]
Identifier: 0x58e4
Sequence: 1
[Response To: 2]
[Response Time: 30.002 ms]
Data (56 bytes)
Data: 000102030405060708090a0b0c0d0e0f1011121314151617...
[Length: 56]

We concentrate on the packets, especially L2 headers information, sent by PC-2 to build our packet in Scapy:

from scapy.all import *

# build L2 headers
L2 = Ether()
L2.src = '0a:00:27:00:00:1c'
L2.dst = 'ca:01:1f:08:00:00'
L2.type = 0x86dd

# build L3 headers
base = IPv6(hlim=128)
base.dst = '2001:4::1'
base.src = '2001:1::1'

# build Protocol and payload part
payload = 'abcdefghijklmnopqrstuvwabcdefghi'
prot = ICMPv6EchoRequest(data=payload, id=0x0001, seq=0x0001)

# build the whole packet
pack = L2 / base / prot
pack.show2()
for i in range(15):
sendp(pack, iface='VirtualBox Host-Only Ethernet Adapter', verbose=conf.verb, count=1)
time.sleep(1)

The processing steps of the script is depicted in Run tab:

The following table compares the packets generated by PC-2 using the ping utility in CMD and Scapy script:

The echo reply requests are compared next :

In Windows 10 Professional Version: 1803, Version OS: 17134.472, the ping echo request is slightly different from Windows 7 Professional:

Let’s generate the same packet with Scapy and see how the networks react.

In the previous code these changes need to be made:

from scapy.all import *

# build L2 headers
L2 = Ether()
L2.src = '0a:00:27:00:00:1c'
L2.dst = 'ca:01:1f:08:00:00'
L2.type = 0x86dd

# build L3 headers
base = IPv6(hlim=128)
base.dst = '2001:4::1'
base.src = '2001:1::1'

ext=IPv6ExtHdrHopByHop(nh=58, len=0, options=RouterAlert())

# build Protocol and payload part
payload = 'abcdefghijklmnopqrstuvwabcdefghi'
prot = ICMPv6EchoRequest(data=payload, id=0x0001, seq=0x0001)

# build the whole packet
pack = L2 / base / ext / prot
pack.show2()
for i in range(15):
sendp(pack, iface='VirtualBox Host-Only Ethernet Adapter', verbose=conf.verb, count=1)
time.sleep(1)

The obtained packet is compared with the one generated by Windows 10 Professional ping utility:

The ping does not succeed!

In the next post, we dig much deeper into this issue…