IT 4510

Scapy 2

Make sure to allow firewall access from on GAIA


Recall a 3 way handshake is:



Example code


    from scapy.all import *


    i.dst = ""

    t = TCP()
    t.dport = 80
    r = sr1(i/t)
    t.flags = "A"
    t.seq = r.ack
    t.ack = r.seq + 1
    p = i/t
    reply = sr(p)

Syn Flood

We must start with this:

sudo iptables -A OUTPUT -p tcp -s --tcp-flags RST RST -j DROP

A better way is this:

iptables -F; iptables -A OUTPUT -p tcp --tcp-flags RST RST -j DROP

Otherwise the kernel sends RST packets to target and Syn flood fails. (Because we are sending packets with scapy, and the OS doesn’t like this, so it tries to tell the target to ignore the connection)

Syn Flood

If you start too many syn requests to a server and never finish the handshake, you can crash the server.

Code to add:

    for p in range(20000, 20010): = p


Remove iptables junk from above:

    iptables -P INPUT ACCEPT
    iptables -P FORWARD ACCEPT
    iptables -P OUTPUT ACCEPT
    iptables -t nat -F
    iptables -t mangle -F
    iptables -F
    iptables -X