sr1 does not capture response for certain packets

[tala23]

Brief description

When sending specific packets with sr1 scapy does not capture the response packet even though Wireshark shows it clearly reaching the client.

This only happens with specific packets. What I was able to find is that it only happens for responses of packets that I send that do not have the SYN nor ACK flags.

Scapy version

2.5.0

Python version

3.10

Operating system

Windows 11 10.0.22621

Additional environment information

No response

How to reproduce

Here are two examples:

# Packet with no flags, from 10.0.0.8 to 10.0.0.8
p1 = '4500003c7f7a40004006a7320a0000080a0000089ef70087ba7e023ee01eef3fa0000080038a000003030a0102040109080affffffff000000000402'
# Packet with the FIN, PSH, URG flags
p2 = '4500003cddf90000400688b30a0000080a0000089efc0050ba7e023ee01eef3fa029ffffff12000003030f0102040109080affffffff000000000402'

sr1(IP(bytes.fromhex(p1))
sr1(IP(bytes.fromhex(p2))

Actual result

Begin emission:.
.Finished sending 1 packets..
........................................................................................

Expected result

The packet should be captured by scapy as shown by Wireshark.

Related resources

No response

[mxmlnhppmnn]

Same issue here.
Using Python 3.11, Scapy 2.5 on
Linux kali 6.0.0-kali6-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.0.12-1kali1 (2022-12-19) x86_64 GNU/Linux

[lukas-popperl]

There could be several reasons that lead to this issue.

1. Incorrect Scapy Implementation

The answers method in the TCP class in inet.py file handles your TCP response incorrectly, and therefore the sr1 function does not recognize the answer.

scapy/scapy/layers/inet.py

Lines 796 to 825 in 181aa4d

	def answers(self, other):
	if not isinstance(other, TCP):
	return 0
	# RST packets don't get answers
	if other.flags.R:
	return 0
	# We do not support the four-way handshakes with the SYN+ACK
	# answer split in two packets (one ACK and one SYN): in that
	# case the ACK will be seen as an answer, but not the SYN.
	if self.flags.S:
	# SYN packets without ACK are not answers
	if not self.flags.A:
	return 0
	# SYN+ACK packets answer SYN packets
	if not other.flags.S:
	return 0
	if conf.checkIPsrc:
	if not ((self.sport == other.dport) and
	(self.dport == other.sport)):
	return 0
	# Do not check ack value for SYN packets without ACK
	if not (other.flags.S and not other.flags.A) \
	and abs(other.ack - self.seq) > 2:
	return 0
	# Do not check ack value for RST packets without ACK
	if self.flags.R and not self.flags.A:
	return 1
	if abs(other.seq - self.ack) > 2 + len(other.payload):
	return 0
	return 1

2. Your TCP Server handles TCP requests incorrectly

It's not totally clear if you are doing a complete TCP Handshake before sending your packets (I don't think this is the case because your provided packets to reproduce this issue only TCP Requests without flags or with FIN, PSH, URG set. The TCP RFC states that without an SYN, ACK or RST flag TCP Request should not be answered in the Listen State see RFC9293 Section 3.10.7.2.

Further Steps

I think the second reasons is more likely to be the cause of the issue, and we should not adapt scapy to support non-standard conform behavior. But I would like to investigate this issues further, therefore it would be really helpful if you could provide the following things:

• PCAP File of the captured Wireshark trace
• The exact Version of the used TCP Sever/Application

[gpotter2]

Hi and sorry for the delay. Could you provide a pcap sample with the request packet and the unmatched answer packet? Thanks

[FelixSchladt]

Hi all,

I am experiencing a very similar issue but instead with tcp mine is simply an ICMP echo (aka ping).

>>> ans = sr1(IP(dst="localhost")/ICMP(id=42), timeout=10)
Begin emission:
Finished sending 1 packets.
.
Received 1 packets, got 0 answers, remaining 1 packets
>>> print(ans)
None

Not sure this is related but thought I will bring it up.

[gpotter2]

Again, as I said, unless one of you provides a reproducible example and a pcap of the answer being ignored by Scapy, this is a wontfix.