security
Packet Sniffer
Python/Scapy coursework project: a UDP client and server on localhost port 12321, a separate adversary script that sniffs their packets, and a simulated dropped-packet-and-resend step.
Role
Developer — team coursework (Cyber Risk Assessment course)
Problem
The assignment was to build a UDP client/server, an adversary that captures their traffic without being part of the connection, and a defense against an active adversary dropping chosen packets, where the client sends an XOR of the data packets so a missing one can be rebuilt. The committed code covers the sniffer and a simpler version of the loss handling: the server asks for a resend instead of rebuilding the packet from the XOR.
Tech Stack
PythonScapyUDP socketspickle
How It Works
- 01server.py binds a UDP socket on localhost:12321, replies to every datagram, and logs each payload and client address.
- 02client.py splits a short message into words, computes an XOR value across them, and sends each word as a pickled (data, xor, d) tuple three seconds apart. It holds back the last word on purpose to simulate a lost packet.
- 03Once the server has buffered two packets it replies 'Resend packet', and the client sends the missing word.
- 04sniffer.py runs separately as the adversary: Scapy's sniff() with a 'port 12321' filter captures packets on that port and prints every layer of each one with packet.show().
What I Learned
- –First hands-on look at networking below the application layer: capturing traffic with Scapy and a packet filter instead of making HTTP requests.
- –The sniffer never joins the connection, yet it prints every layer of each datagram, payload included. Seeing that firsthand made the case for encryption (TLS, VPNs) click far more than reading about it ever did.
- –The commit history shows Flask, a Node.js client/server, and a Docker Compose setup being tried and then removed before the final three Python scripts. For a single-machine exercise, the simplest setup was the one that got finished.