Python如何解析RADIUS服务器数据包？

Question

我正在尝试从RADIUS服务器解析UDP数据包，我尝试过不同的工具，包括Scapy、Pynids和pypcap.The问题--有些是Radius--属性没有被正确解码，有些是正确的。这可能是什么原因？

这是我的密码：

from scapy.all import sniff, Radius

packets = sniff(iface='eth0', filter='udp', count=5)
packet = packets[0]

print packet.show()

下面是我得到的输出的总结：

###[ Ethernet ]### 
   dst       = 94:57:a5:53:ab:70
   src       = d4:ca:6d:ae:a0:66
   type      = 0x800
###[ UDP ]### 
   sport     = 38667
   dport     = radius
   len       = 205
   chksum    = 0x2bbd
###[ Radius ]### 
   code      = Access-Request
   id        = 80
   len       = 197
   authenticator= "T\xfb\x9c\t\x00 '\x14\xeb\x99\x84t\x9b\xb4\x83\x95"
   \attributes\
    |###[ Radius Attribute ]### 
    |  type      = Framed-Protocol
    |  len       = 6
    |  value     = '\x00\x00\x00\x01'
    |###[ Radius Attribute ]### 
    |  type      = NAS-Port
    |  len       = 6
    |  value     = '\x00\xf6\xa7\xf9'
    |###[ Radius Attribute ]### 
    |  type      = Called-Station-Id
    |  len       = 8
    |  value     = 'Dslam1'
    |###[ Radius Attribute ]### 
    |  type      = 87
    |  len       = 16
    |  value     = 'ether1-Dslam 1'
    |###[ Radius Attribute ]### 
    |  type      = Vendor-Specific
    |  len       = 24
    |  value     = '\x00\x00\x017\x0b\x12\x19\xfc4\xd01\xaf\x03\xd6\x0e!j\xa7H]\xdd;'
    |###[ Radius Attribute ]### 
    |  type      = NAS-Identifier
    |  len       = 15
    |  value     = 'TEH-P'

Answer 1

对于未来的访问者来说，这就是我如何解析数据包的方式。

您需要在当前目录中创建一个字典文件，或者使用这里中的一个示例，这样它就可以正确地解析数据类型。

from pyrad.packet import Packet
from pyrad.dictionary import Dictionary

from scapy.all import sniff, Radius

def parse_packet(packet):
    radius_packet = str(packet[Radius])
    pkt = Packet(packet=radius_packet, dict=Dictionary("dictionary"))

    for key, value in pkt.iteritems():
        attr =  pkt._DecodeKey(key)
        value = pkt.__getitem__(attr)
        print attr, value

sniff(iface='eth0', prn=parse_packet, filter="udp", store=0)

这是我得到的一个反应样本：

User-Name [u'12345678']
NAS-IP-Address ['192.168.*.*']
NAS-Port [15853417]
Service-Type ['Framed-User']
Framed-Protocol ['PPP']
Framed-IP-Address ['192.168.*.*']
Called-Station-Id [u'service4']
Calling-Station-Id [u'20:A7:5C:75:RA:TD']
NAS-Identifier [u'Test']
Acct-Status-Type ['Alive']
Acct-Delay-Time [0]
Acct-Input-Octets [1003335]
Acct-Output-Octets [15399190]
Acct-Session-Id [u'81c2332b']
Acct-Authentic ['RADIUS']
Acct-Session-Time [76321]
Acct-Input-Packets [15498]
Acct-Output-Packets [21247]