Python with tcpdump in a subprocess: how to close subprocess properly?

Question

I have a Python script to capture network traffic with tcpdump in a subprocess:

p = subprocess.Popen(['tcpdump', '-I', '-i', 'en1',
                  '-w', 'cap.pcap'], stdout=subprocess.PIPE)
time.sleep(10)
p.kill()

When this script completes its work, I'm trying to open output .pcap file in Wireshark and getting this error:

"The capture file appears to have been cut short in the middle of a packet."

What solution could be applied for "proper" closing of tcpdump's subprocess?

`p.wait()` should wait until the process has finished. I think then that the process is "closed"? — roganjosh, Oct 19 '16 at 19:37
In my case it's "infinite" process (until user or timer not close it) — olpo.graphy, Oct 19 '16 at 19:47
Are you using `p.kill()` in your program or are you interrupting by some other means? — tijko, Oct 19 '16 at 22:52
I'm using `p.kill()` in my program after 10 seconds of capturing — olpo.graphy, Oct 19 '16 at 22:58

score 6 · Accepted Answer · edited Jul 18 '19 at 06:26

6

Instead of p.kill(), you can use p.send_signal(subprocess.signal.SIGTERM) to send a terminate signal rather than a kill (p.terminate() does the same).

The Popen docs describe the send_signal() command. The documentation on signals is a bit weak, but a dir(subprocess.signal) will list all the signals you may send to the process, but terminate should allow it some time to clean up.

edited Jul 18 '19 at 06:26

Guy Avraham

3,482
3
38
50

answered Oct 20 '16 at 17:02

rkh

1,761
1
20
30

score 2 · Answer 2 · edited Jul 20 '19 at 08:48

2

Found working solution:
I've changed p.kill() to p.terminate().
After this change the subprocess is "properly" finished (output of tcpdump subprocess with statistics available in console) and output .pcap file not damaged.

edited Jul 20 '19 at 08:48

Guy Avraham

3,482
3
38
50

answered Oct 20 '16 at 16:58

olpo.graphy

405
8
17

score 1 · Answer 3 · edited Jul 20 '19 at 11:52

I had the same problem about closing subprocesses. This thread really helped, so thanks, especially to https://stackoverflow.com/users/3583715/rkh. My solution:

Before:

output = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, universal_newlines=True)
message = output.stdout.read()
output.stdout.close()

After reading the Popen docs:

output = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, universal_newlines=True)
message = output.stdout.read()
output.TerminateProcess()

For some reason, calling output.kill(), and/or output.terminate() or sending output.send_signal(subprocess.signal.SIGTERM) didn't work, but output.TerminateProcess() did.

Python with tcpdump in a subprocess: how to close subprocess properly?

3 Answers3

Linked