Detecting Dash button ARP requests

Question

I am having some trouble finding working code to find ARP requests sent out by an Amazon dash button. I tried Ted Benson's code, and also this code here, but neither seem to be working.

Ted's code:

from scapy.all import *

def arp_display(pkt):
  if pkt[ARP].op == 1: #who-has (request)
    if pkt[ARP].psrc == '0.0.0.0': # ARP Probe
      print("ARP Probe from: " + pkt[ARP].hwsrc)
print(sniff(prn=arp_display, filter="arp", store=0, count=10))

The issue I am having is with the line scapy.all import *. I get a long list of explanation, but the last line of the error is import dnet ImportError: No module named dnet.

The second code I tried is

import socket
import struct
import binascii

# Written by Bob Steinbeiser (https://medium.com/@xtalker)

rawSocket = socket.socket(socket.AF_PACKET, socket.SOCK_RAW,
                      socket.htons(0x0003))
MAC = '74c24671971c'

while True:
    packet = rawSocket.recvfrom(2048)

    ethernet_header = packet[0][0:14]
    ethernet_detailed = struct.unpack('!6s6s2s', ethernet_header)

    arp_header = packet[0][14:42]
    arp_detailed = struct.unpack('2s2s1s1s2s6s4s6s4s', arp_header)

    # skip non-ARP packets
    ethertype = ethernet_detailed[2]
    if ethertype != '\x08\x06':
        continue

    source_mac = binascii.hexlify(arp_detailed[5])
    dest_ip = socket.inet_ntoa(arp_detailed[8])

    if source_mac == MAC:
        print "Dash button pressed!, IP = " + dest_ip

This is the error I am getting: 'AttributeError: 'module' object has no attribute 'AF_PACKET''.

I have tried both code in python 2.7 and 3.4 and it neither work. Please let me know if there is anything I can do, or any code I can re-appropriate.

Welcome to SO. There is probably not enough information to answer this question. See [how to ask](http://stackoverflow.com/help/how-to-ask) and create a [Minimal, Complete, and Verifiable example](http://stackoverflow.com/help/mcve). — tmthydvnprt, Jul 23 '16 at 15:09

score 0 · Answer 1 · edited May 23 '17 at 10:27

0

For the first example, you are probably missing the libdnet dependency, as discussed in this SO answer.

Also, note that a different approach is required to detect newer model Dash buttons (listening for DHCP requests rather than ARP requests). I describe the solution in this answer.

edited May 23 '17 at 10:27

Community

1
1

answered Oct 07 '16 at 00:04

Tom

1,557
15
19

Detecting Dash button ARP requests

1 Answers1