471,336 Members | 1,359 Online
Bytes | Software Development & Data Engineering Community
Post +

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 471,336 software developers and data experts.

Python Packet Filter - Pcapy?

I'm a newbie to python and for my first project i'm trying to create a packet filter. Having looked around i think pcapy will be the best way, there is a sniffer script available that incorporates a filter function here .. http://oss.coresecurity.com/impacket/sniff.py
I want to filter all SYN packets into a dump file, can anyone tell me how I need to configure the filter string to do this?

Jul 21 '07 #1
2 9269
Just for more info, the following is the documentation from pcapy, I’m trying to find out the syntax I need to use for the bpf compile string and the int filter?
Any help would be appreciated

Bpf compile(linktype, snaplen, filter, optimize, netmask);
int linktype;
int snaplen;
string filter;
int optimize;
int32 netmask;

compile is used to compile the filter into a filter program. snaplen specifies the maximum number of bytes to capture. optimize controls whether optimization on the resulting code is performed. netmask specifies the netmask of the local network.

int filter(packet);
string packet;

filter tests a packet against a compiled filter as returned by pcapy's compile. If the packet is allowed to pass through -1 is returned, otherwise filter returns 0.
Jul 23 '07 #2
Don't know if you still need an answer to this but this is how I do it:

# Create the filter
bpf = pcapy.compile (datalink, 1500, "tcp", 0, 1)

# User the filter
if (bpf.filter(data) == 0):
echo "filtered"
echo "not filtered"
Oct 12 '07 #3

Post your reply

Sign in to post your reply or Sign up for a free account.

Similar topics

1 post views Thread by Emile van Sebille | last post: by
6 posts views Thread by billiejoex | last post: by
2 posts views Thread by billiejoex | last post: by
1 post views Thread by billiejoex | last post: by
3 posts views Thread by Marco Meoni | last post: by
6 posts views Thread by Maxim Veksler | last post: by
reply views Thread by rosydwin | last post: by

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.