So I'm going to use nano here and simply create a script called Python one but p y you probably want
to use a lot better naming convention than that but that's a K for what we are doing here in this demonstration
rather than trying to type this manually I'm going to paste the script in so that I don't make lots
of mistakes.
The first thing we going to do is import pi shock.
This is a variable we're going to use pi shock to live capture of our interface.
Ethan at zero will say that script life config shows us that this is the network interface card.
We can see that ingenious 3 any way but this shows us in Linux that that's our Ethan it card.
I'll edit that script again.
So we're going to capture traffic of Ethan it zero.
We've got a loop here saying for packet in capture we gain to continuously sniff but we're going to
capture 50 packets so this will start ti shock and stop and start capturing packets of the wire but
only 50 packets now don't actually need to write to a file remove that.
What are we going to do here is some exception handling we're going to try and print the source IP address
and destination IP address but some traffic types like spending tree don't have a source destination
IP address.
So they'll give us an error.
So I've got to try statement and if we receive a spanning tree packet it's simply going to say continue
running the loop.
So this pass basically is just a normal statement to put something there so that the script can continue.
I'm then going to print the end and I'm going to exit out of the script.
That sometimes solves the issue that I had with PI shock.
In other words the error that it was displaying.
So let's run that Python 3 Python 1 and the p why what the should hopefully do is start t shock and
start printing out to the source and destination IP addresses.
So as we can see here a source IP address sent traffic to this IP address that's EAI GOP the source
IP address sent traffic to this IP address that's o SPF it's on my road show IP interface brief.
This shows us the IP address of the router show IP protocols shows us of the routing protocols enabled
on this road.
So just scrolling up this IP address is sending updates as we can see over there there's a source IP
address to multicast IP addresses.
Firstly the one for EAI GOP ya GOP uses 10.
This.
Your piece multicast address always preface sending updates.
Here's a wispy PFC multicast IP address so we can see in the updates they that the router is sending
ya GOP updates as well as OSP SPF updates into the network and why shock when this case T shock has
captured those packets.
I started T shock via a python script and then I did something I got it to just print out the source
and destination ip addresses as an example.
Now this once again is that exception era.
I'm going to ignore it for the moment.
This is the end of our script.
What I'll do now is run that script again.
But what I'll do here is I'll ping 1 9 2 1 6 8 1 22 255 so ping a broadcast address.
Notice it's displayed as that 255 255 255 255 so that broadcast Ping has been received by the Y shock
application.
Notice there's the destination multicast address 239
one got one good one do that again.
There's the multicast once again being captured by te shock let's do one two three.
There you go.
So this is a very simple script we're not doing that much yet.
We essentially just printing source and destination IP address.
Well we could do is do something else so let's print out
a GOP
autonomous system no and I should preface that by saying P E S equals that save the script.
So Python 3 Python wondered P why notice we can see in the output that the GOP autonomous system number
is 100.
So again I'm capturing packets in real time off this network
that's a boon to host is capturing packets of Ethan zero and I'll just stop that script at this point.
I can see what the source IP addresses what the destination IP address is and what the GOP autonomous
system number is.
Now this is again a very very basic script you could use if statements here you could do much more complex
things.
So if it's easy GOP then print the autonomous system no if it's spanning tree then do something else.
All those options exist with PI shock and I mean you can leverage the power of Python here to do all
kinds of fancy things.
The moral of the story is I've used Python to start t shock to capture packets of the wire.
Then I'm looking at those packets and then doing something with the information that's captured.
This is a very simple example showing source and destination IP addresses and GOP autonomous system
numbers but you could do something much more complex.