How can i capture the UDP packet and find the TTL Values from the packet using python

Question

HI

I want to capture the UDP packets by joining to the Multicast group. after the receving the packet i want to check for the TTL value from that UDP packet. How can i achieve this by using python ?

The Sammple code as mentioned below: here rec_port is any port which i had used to bind; eg: 9180 rec_hostname is any multicast group which i had joined;eg:239.2.2.2

 #! /usr/bin/env python
    .........
    ............
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    sock.bind(("", rec_port))
    mreq = struct.pack("4sl", socket.inet_aton(rec_hostname), socket.INADDR_ANY)
    sock.setsockopt(socket.IPPROTO_IP, socket.IP_ADD_MEMBERSHIP, mreq)

    total_length = 0
    while True:
            print "Waiting for the packets, if no packets recevied by 10 seconds, than i will exit"
            sock.settimeout(10)
            data , address = sock.recvfrom(2048)
            if len(data) > 1:
                                    total_length=total_length + len(data)
                                    print "Data is:", data
                                    print "Length of data received is:", len(data)
                                    print "Packet recevied from :", address[0]
                                    print "Total Packet size:", total_length
            else:
                    break
    sock.close()
    print "Total Packet size:", total_length

Answer 1

You probably want to use this python wrapper. If it doesn't satisfy you can wrap libpcap yourself.

In response to unwind: You don't have to act "promiscious" with libpcap, you can inject and snoop valid traffic -- i.e., meant for your NIC.

Edit: Read this tutorial on pcap to figure out how to isolate the ttl field.

Answer 2

in a comment, you told us that you are able to join the multicast group.

now you can use getsockopt(), specify IPPROTO_IP for the level parameter and IP_MULTICAST_TTL for the option, to get the TTL value which is written to outgoing packets.