#!/usr/bin/python
# marco.py
# Sends arp requests to the entire network range searching for the first response.
# Creates a second thread to monitor for responses to allow the sending thread to just spew packets.
# The whole point is to find a valid IP when on a completely quiet network segment without DHCP
# or any other means to find a valid address.
# I couldn't seem to figure out how to get nmap to do an arp sweep on a network range that I didn't have
# an IP/interface associated with.
# Requires:
# ipaddr (http://code.google.com/p/ipaddr-py/) and of course scapy (http://www.secdev.org/projects/scapy/)
import ipaddr
import sys
import logging
import getopt
import time
from scapy import *
from threading import Thread
class ArpMonitorThread(Thread):
def __init__(self, map):
Thread.__init__(self)
self.map = map
self.found = []
def arp_callback(self, pkt):
if pkt[ARP].op == 2:
if pkt[ARP].psrc not in self.found:
print pkt[ARP].sprintf("%psrc% (%hwsrc%)")
self.found.append(pkt[ARP].psrc)
if self.map == False:
sys.exit(0)
def run(self):
sniff(filter='(arp) and (not ether dst host ff:ff:ff:ff:ff:ff)', store=0, prn=self.arp_callback)
def usage():
print "python marco.py [-i <iface>] [-n <network/range>] [-t <timeout>] [-s <saddr>] [-c <count>] [-m] [-h]"
print "\tiface: network interface to send and listen on. (default: lo)"
print "\tnetwork/range: network to scan in CIDR notation. (default: 127.0.0.1)"
print "\ttimeout: how long to wait for responses after sending. (default: 0)"
print "\tsaddr: source address to originate the arp packets from. (default: 127.0.0.1)"
print "\tcount: number of times to send the packets (default: 1)"
print "\t-m: Find all hosts on the network not just the first response (default: disabled)"
sys.exit(0)
# Defaults
network = '127.0.0.1'
saddr = '127.0.0.1'
iface = 'lo'
count = 1
map = False
timeout = 0
# Parse our arguments
try:
opts, args = getopt.gnu_getopt(sys.argv[1:], 'i:n:t:s:c:hm', ['interface=', 'network=', 'timeout=', 'saddr=', 'count='])
except getopt.GetoptError, err:
usage()
for o, a in opts:
if o in ('-i', '--interface') :
iface = a
elif o in ('-n', '--network'):
network = a
elif o in ('-t', '--timeout'):
timeout = int(a)
elif o in ('-s', '--saddr'):
saddr = int(a)
elif o in ('-c', '--count'):
count = (int(a) if (int(a) > 0) else 1)
elif o == '-m':
map = True
else:
usage()
# Start the response monitor first
monitor = ArpMonitorThread(map)
monitor.start()
# Create our packet list
pkts = []
for ip in ipaddr.IPv4(network):
pkts.append(Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(psrc=saddr, pdst=ip))
# Send our packets
for i in range(1, count):
sendp(pkts, verbose=0, iface=iface)
# Sleep to make sure we get everything
time.sleep(timeout)
# All packets have been sent
sys.exit(0)
