Now that I've got tea shock and pie shock installed I could run tea shock directly and capture packets
but that's not actually what we want to do.
But notice here we are seeing in real time that we are able to capture spending three packets he has
E.I. GOP he has 0 SPF so I am actually capturing packets of the network but what I want to do is capture
packets and write that to a file so I'm gonna write that to this pickup file tea shop one dot pickup.
Now I want to leave this for a while so that packets are captured but to generate additional traffic.
What I can do on my rota for example is paying some addresses so I could ping as an example 1 on 2 1
6 8 and 122.
And what I'll do here is paying the broadcast address 255 and those packets will be captured
I could ping a multicast address as an example and those packets will be captured.
So various packets are being captured by the T shock application on the TPC.
I could as an example reset it was a process to generate some OSP SPF updates but I mean we've captured
about 60 packets already.
So what I'll do is stop that capture.
So now that I've got my T shock P kept a file on my local directory so
notice I've got that file on my boot to host.
Now that I've captured packets of the network I can open that up with PI shock.
Now in the first example I'm going to show you commands directly from within Python 3 and then I'll
create a script.
So for the moment I just want to show you the commands and the first thing I'm going to do is import
pi shock and then I'm going to say cap.
This could be any name.
This is just a variable pi shock file capture and the follow on to capture is t shock.
One dot pickup that's the why shock capture file cap shows me the fall that I'm using and now I can
do all kinds of things.
Now remember this is from within python.
So if I want to look at the first packet there you go.
Notice we captured a spanning tree packet.
Again this is running within Python can see the length of the packet.
I can see the Ethan at header so I'll make this bigger source Mac address.
Destination Mac address I can see that this is a spending tree BPT you I can see who the route is.
Notice there's root identifier priority Mac address so root bridge properties this for delays this hello
Tom is this route bridge system I.D. this bridge parties this so forth and so on I could look at packet
one as an example this is an easy job P packet so layer two Ethernet header source Mac address destination
MAC address this is the multicast Mac address at least two for IP version 4 notice 10 that's the multicast
address used for EAI GOP ether type is IP V for.
So at least three we have an IP header IP version for DCP set to 6.
Very important traffic source IP addresses this protocol number is 88 Yeah GOP.
So notice at the higher layers we have EAI GOP we can see the K values now this output is all over the
place but notice K one K two K three k for k five k 6 we can see software version we can see the autonomous
system number one hundred forever look at packet two we can see that this is a spending tree update
once again suspending three BBB What about CAP three spending tree cap for this is EAI GOP again five
spanning tree six oh SPF so 6 as always P.F. layer 2 header layer 3 had a notice protocol number is
89.
He has 0 SPF.
Now please remember this is running within Python I'm showing you some basics now but later on I'll
show you how to script stuff so as an example if we looked at Packard one and we use the show option
so print and I don't actually need to use print from within python I could just do it this way.
So cap one show and I actually want to do it this way.
Notice here's my job P packet in pretty format so Ethan it header IP header yeah.
GOP let's look at six a six as I was P.F. if I remember correctly.
Yes it is.
So he has SPF output again this is all being used from within python.
I'm running this output in Python now you might say okay but this doesn't really help me notice what
you could do is I could say Okay print
cap one which was your job P if I remember right IP.
Notice this is the IP header or I could say only show me that ya GOP information so once again this
is everything makes some spaces here.
So this is everything notice print cap 1.
This is everything but what I could do is just look at the IP header or just look at the UI GOP header
or taking this a step further look at the Autonomous System number and that should be an S E number.
S number is 100.
So rather than trying to dig through the information this makes it much easier.
There's this application pie shock allows me to look at specific details I could as an example look
at the parameter k 1 What's K one said to its 1 k to set to 0 k 3 set to 1 k for set to 0 5 0 2 6 0.
The moral of the story is I can burrow into the capture and get information and then store that in a
variable so I could say job P E S equals that and let's get rid of the bracket.
So if I just look at the GOP I yes that's what it is.
And then I could do something with that in my programming
command such as D.R. R work here so I could look at a specific package.
Let's look at the GOP one again and I can see all kinds of options available for that packet so I could
as an example print IP and I'm doing that wrong it should be IP like this.
So there's the IP ahead of once again so let's do that deal over again.
So lot of options available.
In this application.
Notice looking at layers we've got an Ethan and layer IP layer and you hide your IP layer we can look
at the Ethan at header so just look at eith these are Ethan at header we can see source Mac address
destination MAC address a lot of options available here okay so that was basic python.
Let's see if we can create a script.
However rather than doing it directly live coding in Python I have seen this error come up now stack
overflow is a great place to go and look for help.
If you're having problems with programming someone else has had this problem as well where this message
displays so notice as an example that having these errors very similar to me over here and the answer
is to grade the versions of of software.
This was actually a bug in one of the versions of software.
I'm not going to worry too much about that because it doesn't really affect what we're doing here.
Something to clear the screen and what I'm going to do now is create a Python script.