1*6ba48214Sbluhm#!/usr/local/bin/python3 2*6ba48214Sbluhm 3*6ba48214Sbluhmprint("send first ping fragment that ends behind ip max packet size") 4*6ba48214Sbluhm 5*6ba48214Sbluhm# IP_MAXPACKET | 6*6ba48214Sbluhm# |----| 7*6ba48214Sbluhm# |--------| 8*6ba48214Sbluhm# |----| 9*6ba48214Sbluhm 10*6ba48214Sbluhmimport os 11*6ba48214Sbluhmfrom addr import * 12*6ba48214Sbluhmfrom scapy.all import * 13*6ba48214Sbluhm 14*6ba48214Sbluhmpid=os.getpid() 15*6ba48214Sbluhmeid=pid & 0xffff 16*6ba48214Sbluhmpayload=b"ABCDEFGHIJKLMNOP" 17*6ba48214Sbluhmpacket=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \ 18*6ba48214Sbluhm ICMP(type='echo-request', id=eid)/payload 19*6ba48214Sbluhmfrag=[] 20*6ba48214Sbluhmfid=pid & 0xffff 21*6ba48214Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 22*6ba48214Sbluhm frag=8191)/bytes(packet)[36:44]) 23*6ba48214Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 24*6ba48214Sbluhm flags='MF')/bytes(packet)[20:36]) 25*6ba48214Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 26*6ba48214Sbluhm frag=2)/bytes(packet)[36:44]) 27*6ba48214Sbluhmeth=[] 28*6ba48214Sbluhmfor f in frag: 29*6ba48214Sbluhm eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f) 30*6ba48214Sbluhm 31*6ba48214Sbluhmif os.fork() == 0: 32*6ba48214Sbluhm time.sleep(1) 33*6ba48214Sbluhm sendp(eth, iface=LOCAL_IF) 34*6ba48214Sbluhm os._exit(0) 35*6ba48214Sbluhm 36*6ba48214Sbluhmans=sniff(iface=LOCAL_IF, timeout=3, filter= 37*6ba48214Sbluhm "ip and src "+REMOTE_ADDR+" and dst "+LOCAL_ADDR+" and icmp") 38*6ba48214Sbluhmfor a in ans: 39*6ba48214Sbluhm if a and a.type == ETH_P_IP and \ 40*6ba48214Sbluhm a.payload.proto == 1 and \ 41*6ba48214Sbluhm a.payload.frag == 0 and a.payload.flags == 0 and \ 42*6ba48214Sbluhm icmptypes[a.payload.payload.type] == 'echo-reply': 43*6ba48214Sbluhm id=a.payload.payload.id 44*6ba48214Sbluhm print("id=%#x" % (id)) 45*6ba48214Sbluhm if id != eid: 46*6ba48214Sbluhm print("WRONG ECHO REPLY ID") 47*6ba48214Sbluhm exit(2) 48*6ba48214Sbluhm data=a.payload.payload.payload.load 49*6ba48214Sbluhm print("payload=%s" % (data)) 50*6ba48214Sbluhm if data == payload: 51*6ba48214Sbluhm exit(0) 52*6ba48214Sbluhm print("PAYLOAD!=%s" % (payload)) 53*6ba48214Sbluhm exit(1) 54*6ba48214Sbluhmprint("NO ECHO REPLY") 55*6ba48214Sbluhmexit(2) 56