Know Thy Packets - PyCon India 2025

Slides of the talk that Rengaraj and I presented at PyCon India 2025 in September 2025

Associated repo: https://github.com/shrayasr/KnowThyPackets

Transcript

1. KNOW THY PACKETS KNOW THY PACKETS PyCon India 2025
2. Rengaraj @sakthirengaraj
3. Shrayas @shrayasr
4. AIM AIM
5. 2 AIMS 2 AIMS
6. FOSTER CONCEPTUAL THINKING 1
7. UNDERSTAND ABSTRACTIONS 2
8. STORY TIME
9. Earth
22. Firewall Logs
23. Firewall Logs
26. PACKET PACKET RETRANSMITTED PACKET RETRANSMITTED NO ACKNOWLEDGEMENT OF PACKETS TIMEOUT TIMEOUT
27. PACKET PACKETS DON’T GO PAST THE FIREWALL RESET FOUND CONNECTION WAS CLOSED PACKET RESET
28. ALLOW LIST
30. AGENDA AGENDA
31. 1 Assumptions 2 Break down the HTTP&S protocol 3 Look at other protocols 4 SURPRISE 5 Takeaways
32. ASSUMPTIONS ASSUMPTIONS 1
33. TCP/TLS DNS CLASSIC {
34. SIMPLIFICATIONS
35. HTTP&S - BREAKDOWN HTTP&S - BREAKDOWN 2
36. $ curl http://icanhazip.com
37. $ curl http://icanhazip.com
38. $ curl http://icanhazip.com 122.55.27.54
39. HOW MANY REQUESTS?
41. HOW MANY RESPONSES?
43. HOW MANY PACKETS?
45. WHAT
47. PACKETS?
48. PACKET CAPTURE PACKET CAPTURE CRASH COURSE
49. CLIENT SERVER
50. CLIENT SERVER LISTENER
51. CLIENT SERVER TAKE NOTES LISTENER
52. CLIENT SERVER TAKE NOTES LISTENER
54. WIRESHARK
56. SEQUENCE OF CONVERSATION
57. CONVERSING PARTIES
58. LANGUAGE OF CONVERSATION
59. CONTENT OF CONVERSATION
60. CLIENT SERVER TAKE NOTES LISTENER
61. NICE
66. WHERE IS THE SERVER?
67. WHERE IS THE SERVER? DNS
69. LET’S TALK? SURE. OK.
70. LET’S TALK? SURE. OK. 3 WAY HANDSHAKE
72. REQUEST
73. RESPONSE
74. DNS, HANDSHAKE, REQUEST, RESPONSE 10 PACKETS - 1 REQUEST <> RESPONSE
75. PACKET
76. REQUEST
78. Ethernet IP TCP HTTP FRAME
84. HTTP 1 Insecure 2 Uses TCP for controlling transmission 3 Uses IP for addressing
85. $ curl https://icanhazip.com
86. $ curl https://icanhazip.com
87. $ curl https://icanhazip.com 122.55.27.54
88. HOW MANY REQUESTS?
90. HOW MANY RESPONSES?
92. HOW MANY PACKETS?
94. WOAH
95. PACKETSSSSSS
96. WHERE IS THE SERVER? + HANDSHAKE DNS 3 WAY HANDSHAKE
98. U2FsdGVkX18cJt2c49/ANETC7k/ToK/f ox53x1sKW3grmjvwLbpJiSjGkMacqHZP
99. SECURE COMMUNICATION
100. SECURE COMMUNICATION TLS HANDSHAKE
102. REQUEST
103. RESPONSE
104. PACKET
113. HTTP 1 Insecure 2 Uses TCP for controlling transmission 3 Uses IP for addressing
114. HTTPS 1 Insecure 2 Uses TCP for controlling transmission 3 Uses IP for addressing
115. LESSONS?
117. DNS TCP HANDSHAKE REQUEST SSL/TLS RESPONSE U2FsdGVkX19uR9Gv2hK1PAAeaI bUChoEW9N4oxMSBps= U2FsdGVkX1+pshLnokENTX3vqr 036ZdXIauLgVzV79I=
118. BREAKDOWN BREAKDOWN FTP TELNET SSH SFTP FTP TELNET SSH SFTP 3
119. FTP
120. FTP 1️⃣ Port 21 2️⃣ Insecure 3️⃣ Dual channels
124. FTP 1️⃣ Port 21 2️⃣ Insecure 3️⃣ Dual channels
125. TELNET
126. TELNET TCP/IP Client
127. $ telnet 192.168.160.8 21 Trying 192.168.160.8... Connected to 192.168.160.8. Escape character is '^]'.
128. 220-FileZilla Server 1.11.0 USER foo 331 Please, specify the password. PASS bar 230 Login successful.
129. PASV 227 Entering Passive Mode (192,168,160,8,47,28) LIST 150 Starting data transfer. 226 Operation successful
132. TELNET TCP/IP Client
133. SSH
134. SSH 1️⃣ Port 22 2️⃣ Secure
138. FTP
139. FTP SS
140. FTP SSH
141. FTP SSH
142. FTP SSH
143. SFTP
144. SFTP SSH File Transfer Protocol
145. SSH SFTP
146. SSH SFTP
147. SSH SFTP
148. Everything is built on top of everything else
149. DEMO* * Murphy Permitting 4
150. $
151. NOW
152. NOW NEXT
153. NOW NEXT TRACK
154. pyin25
155. NOW
156. NEXT
157. TRACK
158. pyin25
159. SO?
160. $ alias pyin25 = dig +short @127.0.0.1
161. NOW NEXT
165. SCAPY
166. ip = IP( src=query_packet[IP].dst dst=query_packet[IP].src ) udp = UDP( sport=query_packet[UDP].dport, dport=query_packet[UDP].sport )
167. ip = IP( src=query_packet[IP].dst dst=query_packet[IP].src ) udp = UDP( sport=query_packet[UDP].dport, dport=query_packet[UDP].sport )
168. dns = DNS( id = query_packet[DNS].id, qr = 1, # response aa = 1, # authoritative qd = query_packet[DNS].qd, an = answer_txt )
169. dns = DNS( id = query_packet[DNS].id, qr = 1, # response aa = 1, # authoritative qd = query_packet[DNS].qd, an = answer_txt )
170. response = ip / udp / dns
171. response = ip / udp / dns
173. response = ip / udp / dns
174. TAKEAWAYS TAKEAWAYS 5
176. NO MORE MAGIC NO MORE MAGIC
178. NEW SKILL NEW SKILL
180. NEW VOCABULARY NEW VOCABULARY
182. EVERYTHING IS BUILT ON TOP OF EVERYTHING ELSE EVERYTHING IS BUILT ON TOP OF EVERYTHING ELSE
183. FIN FIN Rengaraj & Shrayas github.com/shrayasr/KnowThyPackets These slides and code are released publicly under Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)
184. nadh.in