Skip to content

Add support for HSRPv1 Advertise packets#4972

Open
amlamarra wants to merge 3 commits intosecdev:masterfrom
amlamarra:hsrpv1-advertisement
Open

Add support for HSRPv1 Advertise packets#4972
amlamarra wants to merge 3 commits intosecdev:masterfrom
amlamarra:hsrpv1-advertisement

Conversation

@amlamarra
Copy link
Copy Markdown

@amlamarra amlamarra commented Apr 17, 2026

Scapy was not properly recognizing HSRPv1 Advertisement (opcode 3) packets. The fields are different in these packets.

image image

It doesn't help that the Advertise packets are not detailed in the RFC (2281).

This MR adds support for such packets.

Before:

>>> pkts = rdpcap("hsrp.pcap")
>>> pkts.show()
0000 Ether / IP / UDP 10.28.165.252:1985 > 224.0.0.2:1985 / HSRP / Padding
0001 Ether / IP / UDP 10.28.169.252:1985 > 224.0.0.2:1985 / Raw / Padding

After:

>>> pkts = rdpcap("hsrp.pcap")
>>> pkts.show()
0000 Ether / IP / UDP 10.28.165.252:1985 > 224.0.0.2:1985 / HSRP / Padding
0001 Ether / IP / UDP 10.28.169.252:1985 > 224.0.0.2:1985 / HSRP / Padding
>>> pkts[1].show()
###[ Ethernet ]###
  dst       = 01:00:5e:00:00:02
  src       = 00:12:7f:ba:1f:02
  type      = IPv4
###[ IP ]###
     version   = 4
     ihl       = 5
     tos       = 0xc0
     len       = 44
     id        = 0
     flags     =
     frag      = 0
     ttl       = 1
     proto     = udp
     chksum    = 0x24e7
     src       = 10.28.169.252
     dst       = 224.0.0.2
     \options   \
###[ UDP ]###
        sport     = 1985
        dport     = 1985
        len       = 24
        chksum    = 0xeb0d
###[ HSRP ]###
           version   = 0
           opcode    = Advertise
           adv_type  = HSRP interface state
           adv_length= 14
           adv_state = Passive
           adv_reserved1= 0
           adv_active_grps= 0
           adv_passive_grps= 1
           adv_reserved2 = 1862270976
###[ Padding ]###
              load      = b'\x00\x00'

@p-l-
Copy link
Copy Markdown
Member

p-l- commented Apr 20, 2026

Rather than having many ConditionalFields, maybe you may try having two distinct layers (say, HSRP and HSRPAdvertise) and use a dispatch_hook() method?

@amlamarra
Copy link
Copy Markdown
Author

Thanks, I had never used dispatch_hook() before.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants