When scapy gets bored

Do you remember “Star Wars Traceroute”? Using VRFs and DNS server the Star Wars story is told.

I wrote a small script in python as a PoC that it can be done with scapy without any routing on a single machine. Just for fun.

Traceroute shows the path to the host based on Time Exceed ICMP packets from routers on the path. I have decided that scapy can send these fake replies from some additional IP on a single host.

I used IPv6, 'cause Digital Ocean does not allow to add additional IPv4. It will perfectly work for IPv4 as well.


Usage:

1. block icmp6 from the desired host (or all host) via ip6tables
2. run the script

Here is how mtr looks like to spron.in when script is enabled:

  3.|-- 100ge6-2.core1.ams1.he.ne  0.0%     2   12.5  23.2  12.5  33.9  15.1
  4.|-- 2001:7f8:1:0:a500:20:130:  0.0%     2    9.0   9.1   9.0   9.2   0.0
  5.|-- ???                       100.0     2    0.0   0.0   0.0   0.0   0.0
  6.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   18.4  27.4  18.4  36.3  12.6
  7.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   19.9  18.3  16.6  19.9   2.2
  8.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   28.2  24.5  20.7  28.2   5.3
  9.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   17.9  18.8  17.9  19.7   1.0
 10.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   21.1  22.7  21.1  24.3   2.2
 11.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   20.8  22.7  20.8  24.6   2.6
 12.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   23.5  22.2  20.9  23.5   1.7
 13.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   21.4  21.6  21.4  21.8   0.0
 14.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   20.7  20.8  20.7  20.8   0.0
 15.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   26.1  24.5  23.0  26.1   2.0
 16.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   23.4  23.1  22.9  23.4   0.0
 17.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   20.4  22.3  20.4  24.2   2.6
 18.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   19.4  21.3  19.4  23.3   2.6
 19.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   21.3  21.9  21.3  22.5   0.0
 20.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   20.9  22.2  20.9  23.4   1.7
 21.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   20.1  20.9  20.1  21.6   1.0
 22.|-- 2a03:b0c0:0:1010::32:2003  0.0%     2   16.7  18.9  16.7  21.2   3.0
 23.|-- 2a03:b0c0:0:1010::32:2002  0.0%     2   35.9  25.9  15.9  35.9  14.1

2a03:b0c0:0:1010::32:2003 is an additional IP on my VPS, 2a03:b0c0:0:1010::32:2002 - real one.

Have a look at the script on github.