472,980 Members | 2,202 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 472,980 software developers and data experts.

Python Packet Filter - Pcapy?

16
I'm a newbie to python and for my first project i'm trying to create a packet filter. Having looked around i think pcapy will be the best way, there is a sniffer script available that incorporates a filter function here .. http://oss.coresecurity.com/impacket/sniff.py
I want to filter all SYN packets into a dump file, can anyone tell me how I need to configure the filter string to do this?

Thanks
Jul 21 '07 #1
2 9602
T00l
16
Just for more info, the following is the documentation from pcapy, I’m trying to find out the syntax I need to use for the bpf compile string and the int filter?
Any help would be appreciated

Bpf compile(linktype, snaplen, filter, optimize, netmask);
int linktype;
int snaplen;
string filter;
int optimize;
int32 netmask;

DESCRIPTION
compile is used to compile the filter into a filter program. snaplen specifies the maximum number of bytes to capture. optimize controls whether optimization on the resulting code is performed. netmask specifies the netmask of the local network.

int filter(packet);
string packet;

DESCRIPTION
filter tests a packet against a compiled filter as returned by pcapy's compile. If the packet is allowed to pass through -1 is returned, otherwise filter returns 0.
Jul 23 '07 #2
dninja
1
Don't know if you still need an answer to this but this is how I do it:

# Create the filter
bpf = pcapy.compile (datalink, 1500, "tcp", 0, 1)

# User the filter
if (bpf.filter(data) == 0):
echo "filtered"
else:
echo "not filtered"
Oct 12 '07 #3

Sign in to post your reply or Sign up for a free account.

Similar topics

1
by: Emile van Sebille | last post by:
QOTW: "If we get 2.3.3c1 out in early December, we could release 2.3.3 final before the end of the year, and start 2004 with a 100% bug-free codebase <wink>." -- Tim Peters "cjOr proWe vbCould...
6
by: billiejoex | last post by:
Hi! I made a little, simple program that sends strings over an ICMP packet. The source here: http://billiejoex.altervista.org/a1.txt Now all I need is create a simple network sniffer able to...
2
by: billiejoex | last post by:
Hi all. I'm using pcapy module to sniff some ICMP packets. I would like to modify this source: http://www.google.it/search?hl=it&q=pcapy&btnG=Cerca+con+Google&meta= and visualize only the DATA...
1
by: billiejoex | last post by:
Hi all. I noticed that with the original pcap sniffing library it is possible to listen on multiple devices by using "select()" or "poll()" function. These function aren't present in pcapy module....
3
by: Marco Meoni | last post by:
Hi all! I've a problem with a C++ class that has to be included in a python application. One way to do it is Extending and Embedding the Python Interpreter Now i have 2 questions 1) Is there a...
6
by: Maxim Veksler | last post by:
Hello, I wish to do some low level network stuff using python. I've googled somewhat and came up with pylibpcap, trouble is I can't compile it on my Ubuntu 6.10 workstation. Can someone please...
3
by: nexus024 | last post by:
I am trying to write a program that will continuously sniff eth0 for a specific UDP packet thats being sent to a specific destination IP, alter the data of the packet, and finally transmit it to the...
1
by: sangith | last post by:
Hi, I tried the packet capture module program. I did a file transfer using ftp from this host to another server. But when I ran the program, it was just hanging off and it did not print the...
0
by: neeru29 | last post by:
I'm using Pcapy and impacket module for packet sniffer. I'm able to capture the whole data in a variable and display it. I want extract the IP addresses , Port no's and Payload data into separate...
2
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 4 Oct 2023 starting at 18:00 UK time (6PM UTC+1) and finishing at about 19:15 (7.15PM) The start time is equivalent to 19:00 (7PM) in Central...
0
by: Aliciasmith | last post by:
In an age dominated by smartphones, having a mobile app for your business is no longer an option; it's a necessity. Whether you're a startup or an established enterprise, finding the right mobile app...
0
tracyyun
by: tracyyun | last post by:
Hello everyone, I have a question and would like some advice on network connectivity. I have one computer connected to my router via WiFi, but I have two other computers that I want to be able to...
2
by: giovanniandrean | last post by:
The energy model is structured as follows and uses excel sheets to give input data: 1-Utility.py contains all the functions needed to calculate the variables and other minor things (mentions...
3
NeoPa
by: NeoPa | last post by:
Introduction For this article I'll be using a very simple database which has Form (clsForm) & Report (clsReport) classes that simply handle making the calling Form invisible until the Form, or all...
1
by: Teri B | last post by:
Hi, I have created a sub-form Roles. In my course form the user selects the roles assigned to the course. 0ne-to-many. One course many roles. Then I created a report based on the Course form and...
3
by: nia12 | last post by:
Hi there, I am very new to Access so apologies if any of this is obvious/not clear. I am creating a data collection tool for health care employees to complete. It consists of a number of...
0
NeoPa
by: NeoPa | last post by:
Introduction For this article I'll be focusing on the Report (clsReport) class. This simply handles making the calling Form invisible until all of the Reports opened by it have been closed, when it...
0
isladogs
by: isladogs | last post by:
The next online meeting of the Access Europe User Group will be on Wednesday 6 Dec 2023 starting at 18:00 UK time (6PM UTC) and finishing at about 19:15 (7.15PM). In this month's session, Mike...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.