2

Im building a sniffer with Scapy, python 2.6.6 and windows 7 and I want to know if I can choose the interface to sniff before sniffing, kind of like Wireshark.

oridamari
  • 561
  • 7
  • 12
  • 24

2 Answers2

8

I realize this is a dated post. One of the solutions mentions:

But if no interface is given, sniffing will happen on every interfaces. You can look in the Sniffing section in the Scapy webpage

Unfortunately the documentation is wrong. When no interface is given then the scapy sniffs on conf.iface

Please see the conversation on their github repo:

https://github.com/secdev/scapy/issues/1356

zsnafu
  • 332
  • 3
  • 13
  • I ended up creating a thread for each interface and calling sniff() separately then queueing the packets... – oridamari Aug 20 '19 at 13:26
5

You can use the iface parameter.

sniff(iface="wlan0", prn=exampleFunction)

But if no interface is given, sniffing will happen on every interfaces.

You can look in the Sniffing section in the Scapy webpage

sinkmanu
  • 1,034
  • 1
  • 12
  • 24
  • Can you provide a source for the "sniffing will happen on every interface" statement? – RyPeck Mar 01 '15 at 23:32
  • 1
    http://www.secdev.org/projects/scapy/doc/usage.html In the Sniffing section "We can easily capture some packets or even clone tcpdump or tethereal. If no interface is given, sniffing will happen on every interfaces" – sinkmanu Mar 02 '15 at 06:27
  • if no interface is given, it'll look at all of them, but then if it does, is there a way to see which interface sniffed the packet? – John Sly Jun 24 '15 at 20:29
  • @JohnSly you could [map the MAC address to the interface name](http://stackoverflow.com/questions/5845719/how-do-you-identify-the-interface-of-a-packet-while-listening-to-network-traffic). – eenblam Oct 18 '16 at 21:04
  • This is coming 7 years later but it's worth noting that not specifying `iface` will *not* capture from all interfaces, it will capture from the default one specified by `conf.iface`. – Everyone Feb 05 '22 at 19:23