Sniff() function is not filtering packets as mentioned in the option "filter"

Asked Mar 10 '14 at 13:09

Active Mar 10 '14 at 14:55

Viewed 172 times

I have a Python script that uses Scapy to sniff trafic. I have this line

sp=input('please enter sourceport number')
s="tcp and port "+str(sp)
SYN=sniff(filter=s, iface="eth0",count=1,timeout=60)

The problem is that the result of that includes a NON TCP packet :

Ether / IP / UDP / DNS Qry "daisy.ubuntu.com."

What is the cause of this problem and how can I solve it.

Thanks in advance.

edited Mar 10 '14 at 14:55

Pierre

6,047
1
30
49

asked Mar 10 '14 at 13:09

farfalla

I cannot reproduce that issue. Can you try with the exact same filter with tcpdump and see if you get those UDP packets? – Pierre Mar 10 '14 at 14:52
scapy uses `tcpdump` to compile filters. Is `tcpdump` installed? – Helmut Grohne Mar 10 '14 at 15:32
Possible duplicate: http://stackoverflow.com/q/12011089/3168666 – Helmut Grohne Mar 10 '14 at 15:49
All packages and dependencies are installed – farfalla Mar 10 '14 at 18:26
@Pierre I will try it, I am not very accustomed to tcpdump – farfalla Mar 10 '14 at 18:26
Use `tcpdump -n -i eth0 tcp and port xxx`. BTW when you use Scapy, do you have any warning output? – Pierre Mar 10 '14 at 22:41
Also, can you try with the latest revision from the mercurial repository? (https://bitbucket.org/secdev/scapy/overview) – Pierre Mar 10 '14 at 22:51
@farfalla - to confirm - you want to see all TCP traffic over a certain port? – RyPeck Mar 25 '14 at 18:52
Drop the `and` in your filter and see if that works. – RyPeck Mar 26 '14 at 07:33
Thanks @RyPeck for your suggestion, I will try it as soon as possible and I will inform you about the result – farfalla Mar 26 '14 at 08:08
@RyPeck, Although the filter isn't nice but it is correct. "port 80" means TCP or UDP port 80, so "tcp and port 80" is equal to "tcp port 80". – SuB Mar 15 '15 at 07:53
Consider my answer [here](http://stackoverflow.com/questions/12011089/scapy-bpf-filter-not-working). I have tested it many times using different filters such as tcp, udp, ethernet, ip, etc. – SuB Mar 15 '15 at 07:55

Sniff() function is not filtering packets as mentioned in the option "filter"

0 Answers0