Lab Overview: Create a packet capture file (pcap) using Wireshark or a similar tool, then use Python/Scapy to extract information about the captured traffic. The replit.com environment can be used for Tasks 2 and 3 - the Scapy and ipwhois modules can be installed through the Packages tab. (If you have SEED or Kali VM, Scapy may already be installed there. The ipwhois module may need to be installed separately.) Please see the notes posted on Blackboard under the unit called "More on Scapy and other Modules" for more details to help with this lab, as well as the code demo also posted there.
Submission: Submit a detailed lab report with screenshots of results, code snippets, and a description of what has been done and observed. Submit any time before Wednesday, Feb 16, 11:59pm NY time.
Task 1: Filter Pcap capture to select packets in Python/Scapy
Open the pcap file in Python/Scapy. Modify the code from the class demo of Python/Scapy to create two separate filtered pcap files. Hint: This can be done in the same loop. Create one pcap file with all packets having an IP layer. Create a second pcap file with all other packets.
Task 2: Analysis with Python and tools (IP addresses)
Use Python basic data structures (for example, dictionaries and lists), as well as the IPwhois module, to find out more information about the packets in the first file created in task 1. From the pcap file with IP layers, save the destination IP addresses. Hint: Use a loop again to read the packets and append each destination IP to a list. How many total destination IPs are there in the list? Hint: Use Python's len() function to find out how many items are in a data structure. How many unique destination IPs are there? Hint: Create a Python set() from the list of IPs to eliminate the duplicates. Use ipwhois to find and print to the screen the asn, country code, and asn_date for each unique IP.
Task 3: Analysis with Python and tools (other packets)
Use Python/Scapy to look at the packets saved in the second pcap file created in task 1. What can you find out about those packets? You can print the packets or use Is() or show() to see more information. Can you see what protocols are used or any data?