Skip to content

Add support for HSRPv1 Advertise packets#4972

Merged
gpotter2 merged 3 commits into
secdev:masterfrom
amlamarra:hsrpv1-advertisement
May 2, 2026
Merged

Add support for HSRPv1 Advertise packets#4972
gpotter2 merged 3 commits into
secdev:masterfrom
amlamarra:hsrpv1-advertisement

Conversation

@amlamarra
Copy link
Copy Markdown
Contributor

@amlamarra amlamarra commented Apr 17, 2026

Scapy was not properly recognizing HSRPv1 Advertisement (opcode 3) packets. The fields are different in these packets.

image image

It doesn't help that the Advertise packets are not detailed in the RFC (2281).

This MR adds support for such packets.

Before:

>>> pkts = rdpcap("hsrp.pcap")
>>> pkts.show()
0000 Ether / IP / UDP 10.28.165.252:1985 > 224.0.0.2:1985 / HSRP / Padding
0001 Ether / IP / UDP 10.28.169.252:1985 > 224.0.0.2:1985 / Raw / Padding

After:

>>> pkts = rdpcap("hsrp.pcap")
>>> pkts.show()
0000 Ether / IP / UDP 10.28.165.252:1985 > 224.0.0.2:1985 / HSRP / Padding
0001 Ether / IP / UDP 10.28.169.252:1985 > 224.0.0.2:1985 / HSRP / Padding
>>> pkts[1].show()
###[ Ethernet ]###
  dst       = 01:00:5e:00:00:02
  src       = 00:12:7f:ba:1f:02
  type      = IPv4
###[ IP ]###
     version   = 4
     ihl       = 5
     tos       = 0xc0
     len       = 44
     id        = 0
     flags     =
     frag      = 0
     ttl       = 1
     proto     = udp
     chksum    = 0x24e7
     src       = 10.28.169.252
     dst       = 224.0.0.2
     \options   \
###[ UDP ]###
        sport     = 1985
        dport     = 1985
        len       = 24
        chksum    = 0xeb0d
###[ HSRP ]###
           version   = 0
           opcode    = Advertise
           adv_type  = HSRP interface state
           adv_length= 14
           adv_state = Passive
           adv_reserved1= 0
           adv_active_grps= 0
           adv_passive_grps= 1
           adv_reserved2 = 1862270976
###[ Padding ]###
              load      = b'\x00\x00'

@p-l-
Copy link
Copy Markdown
Member

p-l- commented Apr 20, 2026

Rather than having many ConditionalFields, maybe you may try having two distinct layers (say, HSRP and HSRPAdvertise) and use a dispatch_hook() method?

@amlamarra
Copy link
Copy Markdown
Contributor Author

Thanks, I had never used dispatch_hook() before.

@gpotter2 gpotter2 enabled auto-merge (squash) May 2, 2026 09:18
@codecov
Copy link
Copy Markdown

codecov Bot commented May 2, 2026

Codecov Report

❌ Patch coverage is 94.73684% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 80.27%. Comparing base (5009233) to head (e2ed46d).
⚠️ Report is 15 commits behind head on master.

Files with missing lines Patch % Lines
scapy/layers/hsrp.py 94.73% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #4972      +/-   ##
==========================================
- Coverage   80.31%   80.27%   -0.04%     
==========================================
  Files         381      381              
  Lines       93630    93734     +104     
==========================================
+ Hits        75202    75249      +47     
- Misses      18428    18485      +57     
Files with missing lines Coverage Δ
scapy/layers/hsrp.py 91.66% <94.73%> (+1.66%) ⬆️

... and 15 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@gpotter2 gpotter2 merged commit 8c5a9a8 into secdev:master May 2, 2026
24 checks passed
@gpotter2
Copy link
Copy Markdown
Member

gpotter2 commented May 2, 2026

Thanks for the PR !

@amlamarra amlamarra deleted the hsrpv1-advertisement branch May 3, 2026 17:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants