secdev / scapy

Scapy: the Python-based interactive packet manipulation program & library.
https://scapy.net
GNU General Public License v2.0
10.29k stars 1.99k forks source link

Problem with NBNS - NBNSHeader / NBNSQueryResponse #4404

Closed adamziaja closed 3 weeks ago

adamziaja commented 1 month ago

Brief description

When on the old version of Scapy 2.4.4 I read the PCAP with NBNS communication and display as a command there is no problem and everything is logical. However on the new version 2.5.0 there are problems - no name and ip address. The same problem occurs when trying to generate a packet - no possible to generate a valid NBNS response.

Scapy version

2.5.0

Python version

3.12.3

Operating system

Ubuntu 24.04 LTS

Additional environment information

No response

How to reproduce

https://www.cloudshark.org/captures/52c50f52cc5b

python3-scapy

Version: 2.4.4-4ubuntu1

Ether(dst='00:07:95:d9:30:fe', src='00:1d:09:f0:92:ac', type=2048)/IP(version=4, ihl=5, tos=0, len=90, id=0, flags=2, frag=0, ttl=64, proto=17, chksum=46781, src='192.168.1.65', dst='192.168.1.68')/UDP(sport=137, dport=51427, len=70, chksum=33837)/NBNSQueryResponse(NAME_TRN_ID=12115, FLAGS=34176, QDCOUNT=0, ANCOUNT=1, NSCOUNT=0, ARCOUNT=0, RR_NAME=b'POTATO         ', SUFFIX=16705, NULL=0, QUESTION_TYPE=32, QUESTION_CLASS=1, TTL=259200, RDLENGTH=6, NB_FLAGS=0, NB_ADDRESS='192.168.1.65')

Version: 2.5.0+dfsg-2ubuntu1

Ether(dst='00:07:95:d9:30:fe', src='00:1d:09:f0:92:ac', type=2048)/IP(version=4, ihl=5, tos=0, len=90, id=0, flags=2, frag=0, ttl=64, proto=17, chksum=46781, src='192.168.1.65', dst='192.168.1.68')/UDP(sport=137, dport=51427, len=70, chksum=33837)/NBNSHeader(NAME_TRN_ID=12115, RESPONSE=1, OPCODE=0, NM_FLAGS=88, RCODE=0, QDCOUNT=0, ANCOUNT=1, NSCOUNT=0, ARCOUNT=0)/Raw(load=b' FAEPFEEBFEEPCACACACACACACACACAAA\x00\x00 \x00\x01\x00\x03\xf4\x80\x00\x06\x00\x00\xc0\xa8\x01A')

Actual result

No response

Expected result

No response

Related resources

No response

gpotter2 commented 1 month ago

Hi. Should be fixed in https://github.com/secdev/scapy/pull/4406, feel free to try it out