My First Scapied IPv6 Packet

In this blog, let’s build our first IPv6 packet.

Introduction

The idea of this lab is to craft an IPv6 packet from scratch using Python and Scapy library. The IDE I use is JetBrains PyCharm Community Edition 2018.3.1 x64 which is available for free at : https://www.jetbrains.com/pycharm/download/download-thanks.html?platform=windows&code=PCC

The IDE

The IDE interface looks like in figure:

Scappy

You’ll need to add Scapy library in Project Interpreter section (File->Settings):

The test network

In my lab setup I use GN3 Version 2.1.11 x64 with Python 3.6.6 Qt 5.9.1 and PyQt 5.9.

R1 connects to real world (PC-2, my workstation running Windows 7 Professional SP1) through Switch-1. PC-2 “test” interface is a VirtualBox Host-Only Ethernet Adapter.

R1, R2 and R3 interfaces are in OSPF domain area 0.

Check the routing

We check that routing is working and PC-1 can ping PC-2:

R1#sh ipv route ospf
IPv6 Routing Table - default - 7 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
IS - ISIS summary, D - EIGRP, EX - EIGRP external, ND - ND Default
NDp - ND Prefix, DCE - Destination, NDr - Redirect, O - OSPF Intra
OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2, ON1 - OSPF NSSA ext 1
ON2 - OSPF NSSA ext 2
O 2001:3::/126 [110/2]
via FE80::C802:7FF:FEC4:1C, FastEthernet1/0
O 2001:4::/126 [110/3]
via FE80::C802:7FF:FEC4:1C, FastEthernet1/0
R1#


R3#sh ipv route ospf
IPv6 Routing Table - default - 8 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
IS - ISIS summary, D - EIGRP, EX - EIGRP external, ND - ND Default
NDp - ND Prefix, DCE - Destination, NDr - Redirect, O - OSPF Intra
OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2, ON1 - OSPF NSSA ext 1
ON2 - OSPF NSSA ext 2
O 2001:1::/126 [110/3]
via FE80::C802:7FF:FEC4:1D, FastEthernet1/1
O 2001:2::/126 [110/2]
via FE80::C802:7FF:FEC4:1D, FastEthernet1/1
R3#

PC-1> ping 2001:1::1

2001:1::1 icmp6_seq=1 ttl=61 time=40.002 ms
2001:1::1 icmp6_seq=2 ttl=61 time=38.002 ms
2001:1::1 icmp6_seq=3 ttl=61 time=39.002 ms
2001:1::1 icmp6_seq=4 ttl=61 time=39.003 ms
2001:1::1 icmp6_seq=5 ttl=61 time=40.002 ms

PC-1>

Wireshark

A wireshark capture shows the detail of the echo request as it is sent by PC-1:

Frame 3: 118 bytes on wire (944 bits), 118 bytes captured (944 bits) on interface 0
Interface id: 0 (-)
Interface name: -
Encapsulation type: Ethernet (1)
Arrival Time: Dec 21, 2018 13:53:44.166908000 Paris, Madrid
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1545396824.166908000 seconds
[Time delta from previous captured frame: 6.907395000 seconds]
[Time delta from previous displayed frame: 6.907395000 seconds]
[Time since reference or first frame: 16.181925000 seconds]
Frame Number: 3
Frame Length: 118 bytes (944 bits)
Capture Length: 118 bytes (944 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ipv6:icmpv6:data]
[Coloring Rule Name: ICMP]
[Coloring Rule String: icmp || icmpv6]

Ethernet II, Src: Private_66:68:00 (00:50:79:66:68:00), Dst: ca:03:0c:6c:00:00 (ca:03:0c:6c:00:00)
Destination: ca:03:0c:6c:00:00 (ca:03:0c:6c:00:00)
Address: ca:03:0c:6c:00:00 (ca:03:0c:6c:00:00)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: Private_66:68:00 (00:50:79:66:68:00)
Address: Private_66:68:00 (00:50:79:66:68:00)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv6 (0x86dd)

Internet Protocol Version 6, Src: 2001:4::1, Dst: 2001:1::1
0110 .... = Version: 6
.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
.... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
.... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
.... .... .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
Payload Length: 64
Next Header: ICMPv6 (58)
Hop Limit: 64
Source: 2001:4::1
Destination: 2001:1::1

Internet Control Message Protocol v6
Type: Echo (ping) request (128)
Code: 0
Checksum: 0xef85 [correct]
[Checksum Status: Good]
Identifier: 0x58e2
Sequence: 1
[Response In: 6]
Data (56 bytes)
Data: 000102030405060708090a0b0c0d0e0f1011121314151617...
[Length: 56]

The same packet that is seen by PC-2:

Frame 2: 118 bytes on wire (944 bits), 118 bytes captured (944 bits) on interface 0
Interface id: 0 (-)
Interface name: -
Encapsulation type: Ethernet (1)
Arrival Time: Dec 21, 2018 14:02:16.750226000 Paris, Madrid
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1545397336.750226000 seconds
[Time delta from previous captured frame: 7.890451000 seconds]
[Time delta from previous displayed frame: 7.890451000 seconds]
[Time since reference or first frame: 7.890451000 seconds]
Frame Number: 2
Frame Length: 118 bytes (944 bits)
Capture Length: 118 bytes (944 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ipv6:icmpv6:data]
[Coloring Rule Name: ICMP]
[Coloring Rule String: icmp || icmpv6]

Ethernet II, Src: ca:01:1f:08:00:00 (ca:01:1f:08:00:00), Dst: 0a:00:27:00:00:1c (0a:00:27:00:00:1c)
Destination: 0a:00:27:00:00:1c (0a:00:27:00:00:1c)
Address: 0a:00:27:00:00:1c (0a:00:27:00:00:1c)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: ca:01:1f:08:00:00 (ca:01:1f:08:00:00)
Address: ca:01:1f:08:00:00 (ca:01:1f:08:00:00)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv6 (0x86dd)

Internet Protocol Version 6, Src: 2001:4::1, Dst: 2001:1::1
0110 .... = Version: 6
.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
.... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
.... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
.... .... .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
Payload Length: 64
Next Header: ICMPv6 (58)
Hop Limit: 61
Source: 2001:4::1
Destination: 2001:1::1
Internet Control Message Protocol v6
Type: Echo (ping) request (128)
Code: 0
Checksum: 0xef83 [correct]
[Checksum Status: Good]
Identifier: 0x58e4
Sequence: 1
[Response In: 5]
Data (56 bytes)
Data: 000102030405060708090a0b0c0d0e0f1011121314151617...
[Length: 56]

Packet analysis

The detailed packet echo response that is seen by PC-1:

Frame 6: 118 bytes on wire (944 bits), 118 bytes captured (944 bits) on interface 0
Interface id: 0 (-)
Interface name: -
Encapsulation type: Ethernet (1)
Arrival Time: Dec 21, 2018 13:53:44.249913000 Paris, Madrid
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1545396824.249913000 seconds
[Time delta from previous captured frame: 0.010001000 seconds]
[Time delta from previous displayed frame: 0.010001000 seconds]
[Time since reference or first frame: 16.264930000 seconds]
Frame Number: 6
Frame Length: 118 bytes (944 bits)
Capture Length: 118 bytes (944 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ipv6:icmpv6:data]
[Coloring Rule Name: ICMP]
[Coloring Rule String: icmp || icmpv6]

Ethernet II, Src: ca:03:0c:6c:00:00 (ca:03:0c:6c:00:00), Dst: Private_66:68:00 (00:50:79:66:68:00)
Destination: Private_66:68:00 (00:50:79:66:68:00)
Address: Private_66:68:00 (00:50:79:66:68:00)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: ca:03:0c:6c:00:00 (ca:03:0c:6c:00:00)
Address: ca:03:0c:6c:00:00 (ca:03:0c:6c:00:00)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv6 (0x86dd)

Internet Protocol Version 6, Src: 2001:1::1, Dst: 2001:4::1
0110 .... = Version: 6
.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
.... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
.... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
.... .... .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
Payload Length: 64
Next Header: ICMPv6 (58)
Hop Limit: 61
Source: 2001:1::1
Destination: 2001:4::1
Internet Control Message Protocol v6
Type: Echo (ping) reply (129)
Code: 0
Checksum: 0xee85 [correct]
[Checksum Status: Good]
Identifier: 0x58e2
Sequence: 1
[Response To: 3]
[Response Time: 83.005 ms]
Data (56 bytes)
Data: 000102030405060708090a0b0c0d0e0f1011121314151617...
[Length: 56]

The detailed packet echo response that is sent by PC-2:

Frame 5: 118 bytes on wire (944 bits), 118 bytes captured (944 bits) on interface 0
Interface id: 0 (-)
Interface name: -
Encapsulation type: Ethernet (1)
Arrival Time: Dec 21, 2018 14:02:16.780228000 Paris, Madrid
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1545397336.780228000 seconds
[Time delta from previous captured frame: 0.001000000 seconds]
[Time delta from previous displayed frame: 0.001000000 seconds]
[Time since reference or first frame: 7.920453000 seconds]
Frame Number: 5
Frame Length: 118 bytes (944 bits)
Capture Length: 118 bytes (944 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ipv6:icmpv6:data]
[Coloring Rule Name: ICMP]
[Coloring Rule String: icmp || icmpv6]

Ethernet II, Src: 0a:00:27:00:00:1c (0a:00:27:00:00:1c), Dst: ca:01:1f:08:00:00 (ca:01:1f:08:00:00)
Destination: ca:01:1f:08:00:00 (ca:01:1f:08:00:00)
Address: ca:01:1f:08:00:00 (ca:01:1f:08:00:00)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: 0a:00:27:00:00:1c (0a:00:27:00:00:1c)
Address: 0a:00:27:00:00:1c (0a:00:27:00:00:1c)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv6 (0x86dd)

Internet Protocol Version 6, Src: 2001:1::1, Dst: 2001:4::1
0110 .... = Version: 6
.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
.... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
.... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
.... .... .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
Payload Length: 64
Next Header: ICMPv6 (58)
Hop Limit: 64
Source: 2001:1::1
Destination: 2001:4::1
Internet Control Message Protocol v6
Type: Echo (ping) reply (129)
Code: 0
Checksum: 0xee83 [correct]
[Checksum Status: Good]
Identifier: 0x58e4
Sequence: 1
[Response To: 2]
[Response Time: 30.002 ms]
Data (56 bytes)
Data: 000102030405060708090a0b0c0d0e0f1011121314151617...
[Length: 56]

L2 header information

We concentrate on the packets, especially L2 headers information, sent by PC-2 to build our packet in Scapy:

from scapy.all import *

# build L2 headers
L2 = Ether()
L2.src = '0a:00:27:00:00:1c'
L2.dst = 'ca:01:1f:08:00:00'
L2.type = 0x86dd

# build L3 headers
base = IPv6(hlim=128)
base.dst = '2001:4::1'
base.src = '2001:1::1'

# build Protocol and payload part
payload = 'abcdefghijklmnopqrstuvwabcdefghi'
prot = ICMPv6EchoRequest(data=payload, id=0x0001, seq=0x0001)

# build the whole packet
pack = L2 / base / prot
pack.show2()
for i in range(15):
sendp(pack, iface='VirtualBox Host-Only Ethernet Adapter', verbose=conf.verb, count=1)
time.sleep(1)

The script into run

The processing steps of the script is depicted in Run tab:

Echo request packet comparison

The following table compares the packets generated by PC-2 using the ping utility in CMD and Scapy script:

Echo reply packet comparison

The echo reply requests are compared next :

The ping between windows versions

In Windows 10 Professional Version: 1803, Version OS: 17134.472, the ping echo request is slightly different from Windows 7 Professional:

Let’s generate the same packet with Scapy and see how the networks react.

In the previous code these changes need to be made:

from scapy.all import * # build L2 headers L2 = Ether() L2.src = ‘0a:00:27:00:00:1c’ L2.dst = ‘ca:01:1f:08:00:00’ L2.type = 0x86dd # build L3 headers base = IPv6(hlim=128) base.dst = ‘2001:4::1’ base.src = ‘2001:1::1’ ext=IPv6ExtHdrHopByHop(nh=58, len=0, options=RouterAlert()) # build Protocol and payload part payload = ‘abcdefghijklmnopqrstuvwabcdefghi’ prot = ICMPv6EchoRequest(data=payload, id=0x0001, seq=0x0001) # build the whole packet pack = L2 / base / ext / prot pack.show2() for i in range(15): sendp(pack, iface=’VirtualBox Host-Only Ethernet Adapter’, verbose=conf.verb, count=1) time.sleep(1)

The obtained packet is compared with the one generated by Windows 10 Professional ping utility:

The ping does not succeed!

In the next post, we dig much deeper into this issue…