Scapy BPF filter not working

Question

I am using Scapy and would like to filter based on the destination mac address.

However, I am getting packets displayed where the destination MAC address is not the address specified in the filter.

Here is a code snippit:

from scapy.all import *

sniff(iface="eth1", filter="ether dst host 91:e0:f0:01:00:00", 
      count=3, prn=lambda x: x.show())

I am running Scapy 2.2.0

Any ideas on the issue here?

Tried the code on my system, same version of scapy. The filter worked. What kinds of MAC addresses are getting through the filter? — RyPeck, Jun 17 '13 at 22:30

score 2 · Answer 1 · answered Jun 18 '13 at 15:38

2

Scapy requires numerous dependencies for many different systems. It is quiet possible that you don't have the required dependency for BPF filters to work.

http://www.secdev.org/projects/scapy/portability.html

answered Jun 18 '13 at 15:38

RyPeck

7,830
3
38
58

score 2 · Answer 2 · answered Jun 25 '15 at 13:14

2

Installing tcpdump solved the problem for me - now the filter on sniff works

answered Jun 25 '15 at 13:14

elotic

61
2

score 2 · Answer 3 · answered Feb 08 '18 at 02:27

2

In my case, upgrading to 2.3.3dev (github version), fixed it

answered Feb 08 '18 at 02:27

Cukic0d

5,111
2
19
48

score 0 · Answer 4 · answered Mar 15 '15 at 07:43

It's scapy fault!!! It seems that scapy starts receiving packets before applying the BPF filter (filter argument of sniff function). It takes a while to get work properly! Two methods to get rid of this:

Use lfilter to define your filtering function inside the script. It's not efficient on busy link because filter is applied in your script, instead of kernel. Consider using pypy to speed it up.
For some first packets check destination MAC address inside your script and then don't check it anymore; i.e check correctness of the packet in the beginning time of sniffing to pass unstable phase of scapy and then rely on scapy to filter the unwanted packets.

Sure, upgrading it seems to fix the thing – Cukic0d Feb 11 '18 at 10:57 — Cukic0d, Feb 11 '18 at 10:57

Scapy BPF filter not working

4 Answers4

Linked