The script reads WLAN packets, looks for probe requests and then extracts SSID, MAC address and then stores them in a list if the MAC address/SSID combo is unique.
if p.haslayer(Dot11ProbeReq): if pc == 0: print O+'[+]'+W+' Got first packet! Many more to go...\n' if p.haslayer(Dot11Elt): pc +=1 vali = 0 if p.ID == 0: ssid = p.info if ssid != "": for (i,j) in obs: if (i,j) != (p.addr2,ssid): vali += 1 else: break if vali == len(obs): obs.append((p.addr2,ssid)) checkmac(p.addr2) checknet(ssid) count +=1 get_oui(p.addr2) print str(count)+'>',p.addr2+' ('+G+macf+W+') <--Probing--> '+O+ssid+W wr_log(p.addr2,ssid,macf) else: pass
What modifications can I make to make the code faster, specially the
for block and the validation process? Any other optimizations or practices that I should be following?
This script is reliant on the scapy library. Here
p is a packet that scapy intercepts. It could be any type of packet - management, data or control etc. and can be of any subtype - deauthentication, probe response, authentication, probe request etc. The function that I have mentioned above reads each packet
p and processes it the way I desire. The code begins with intercepting any packet
p from the air and checking if the packet is a probe request. A probe request is emitted by all wifi enabled devices when they are looking to connect to a wifi network if they can't find one or even if they are connected, then to find a backup network in case the currently connected network fails. These probe requests are automatic and the users don't get to choose anything about them. The devices will emit these requests broadcasting a list of known wireless networks to check if there is any of them available nearby. After the packet is confirmed to be a probe request, the packet counter (
pc) checks if it is the first packet, if it is then it displays a message confirming that we are able to receive requests and the network is up. Then the function checks whether the packet has a
Dot11Elt layer, which is the information element that contains all the info about the device and previously connected wireless networks. If it does have an information layer then the value in the first information layer, which happens to be the ssid of a previously connected network, is stored in a variable called
ssid. the variable
p.addr2 is the MAC address of the device that the packet came from. Each MAC/SSID pair found is stored in an orderly fashion inside the list
obs. Each packet intercepted, as many can be duplicates, are checked against the ones already stored in
obs and if unique against each pair already stored, then the value of the
vali (validation counter) is incremented. Needless to say, if the value of
vali is the same as the length of
obs then the packet is unique and did not match any other (MAC/SSID) pair stored in
obs and is hence, printed. Before printing, the unique (MAC/SSID) pair is appended to the list
obs and the functions
checknet() check whether the MAC address or the SSID is unique, if they are then a counter is incremented and that helps us to identify unique devices and unique networks after the script stops running. The function
get_oui() gets the manufacturer name though the use of netaddr library for each and every MAC address we find and
wr_log() writes the MAC address, SSID name and manufacturer info in a log file.