新来的。试图理解sr（）

Question

我是scapy的新手，我试图使用sr和sr1函数来理解它们的工作原理。

我试着制作下面的包，我看到它已经发送了1个包，但它说它已经收到581个包。有人能帮我弄明白为什么会显示收到这么多的包裹吗。

收到了1373个包，得到了0个答案，剩下1个包

>>> p=sr(IP(dst="192.168.25.1")/TCP(dport=23))
.Begin emission:
.....Finished to send 1 packets.
...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^C
Received 581 packets, got 0 answers, remaining 1 packets
>>> p
(<Results: TCP:0 UDP:0 ICMP:0 Other:0>, <Unanswered: TCP:1 UDP:0 ICMP:0 Other:0>)

我的TCPDump输出没有显示它接收了这么多数据包。

Answer 1

sr()和sr1()函数将发送一个数据包并在网络上侦听在sr()情况下的相应答案，sr1()将只等待一个答案。

接收到但不是应答的数据包是Scapy在寻找对原始数据包的响应时嗅到的数据包。我不确定在使用Scapy的同时使用tcpdump嗅探将如何影响结果-不确定内核将向哪个进程传递数据包。

这是一个关于Sending and Receiving with Scapy的优秀教程，来自packetgeek。

还要确保在解释器中使用各种Scapy函数的__doc__属性来获取相关文档。

>>> print sr1.__doc__
Send packets at layer 3 and return only the first answer
nofilter: put 1 to avoid use of bpf filters
retry:    if positive, how many times to resend unanswered packets
          if negative, how many times to retry when no more packets are answered
timeout:  how much time to wait after the last packet has been sent
verbose:  set verbosity level
multi:    whether to accept multiple answers for the same stimulus
filter:   provide a BPF filter
iface:    listen answers only on the given interface
>>>