0

I am trying to sniff from all interfaces using scapy, but when I attempt to provide a list of interfaces I get below Error:

sniff(iface=["eth1","eth2"], prn=lambda x: x.sniffed_on+": "+x.summary())
File "C:\Users\a\AppData\Local\Programs\Python\Python39\lib\site-packages\scapy\sendrecv.py", line 1263, in sniff
sniffer._run(*args, **kwargs)
File "C:\Users\a\AppData\Local\Programs\Python\Python39\lib\site-packages\scapy\sendrecv.py", line 1127, in _run
sniff_sockets[L2socket(type=ETH_P_ALL, iface=iface,
File "C:\Users\a\AppData\Local\Programs\Python\Python39\lib\site-packages\scapy\arch\libpcap.py", line 376, in __init__
self.ins = open_pcap(iface, MTU, self.promisc, 100,
File "C:\Users\a\AppData\Local\Programs\Python\Python39\lib\site-packages\scapy\arch\windows\__init__.py", line 704, in open_pcap
return _orig_open_pcap(iface_network_name, *args, **kargs)
File "C:\Users\a\AppData\Local\Programs\Python\Python39\lib\site-packages\scapy\arch\libpcap.py", line 231, in __init__
self.iface = create_string_buffer(device.encode("utf8"))

AttributeError: 'list' object has no attribute 'encode'

below is my script:

def main():
    sniff(iface=["Ethernet","Wi-Fi"], prn=lambda x: x.sniffed_on+": "+x.summary())

def process_packet(packet):
    print(packet)

Can someone tell me what is the problem here? or how to sniff from all/multiple interfaces and process with function process_packet?

My scapy version is 2.4.5 on windows 10 x64

Ross Jacobs
  • 2,962
  • 1
  • 17
  • 27
hashy
  • 175
  • 10

1 Answers1

1

There is a problem in scapy. It is described in the issue #3191:

Basic sniff capture using multiple interfaces.

When passing a list (or dict) of interfaces, Scapy raises an exception (see below).

[...]

Thanks for reporting the issue. That is indeed a regression!

They identified the commit and it seems specific of the version 2.4.5.

Try with the version 2.4.4. If you use pip you can try with:

pip install scapy==2.4.4
Hernán Alarcón
  • 3,494
  • 14
  • 16
  • That seem to fix the error, but I noticed that it do not capture all the packets or most likely not from all interfaces. If I specify I.e Wi-Fi only I see that it captures alot more traffic than a list of interfaces. Would you know why is that? – hashy May 13 '21 at 17:25
  • @hashy, sorry, I do not know. – Hernán Alarcón May 13 '21 at 19:09