Comments (7)
The need for be able to set the immediate flag has become more urgent when using the latest libpacp library in linux.
In the latest version of libpcap(1.8.1 and above... see the-tcpdump-group/libpcap#572), the timeout parameter for pcapy_open_live doesn't cause the next function to return after waiting until timeout like in earlier version. In 1.8.1, the next function will wait until it receives a packet and the timeout is the amount of time to buffer a packet.
The solution to the problem is to set immediate mode so it will return when no packets have been received.
from pcapy.
@csavoie You're saying this is possible now with the current code base or you're just elaborating on how it should be done?
from pcapy.
@brifordwylie I have reproduced this problem in sles12 sp2 which has updated the libpcap package to 1.8.1. I have a python script that snoops for vrrp packets in a closed network. If it is first system online, it will wait forever for a packet even though I set a timeout 60 seconds. I traced it down to the change in behavior of the timeout parameter for pcap_open_live().
from pcapy.
@csavoie just to be explicit. Let me restate the feature request with example code :)
With the pypcap module (for instance) you can set the immediate flag to true and this code will immediately begin printing packets as they arrive:
import pcap
sniffer = pcap.pcap(name=None, promisc=True, immediate=True)
for ts, pkt in sniffer:
print ts, repr(pkt)
The equivalent code with pcapy will often wait a couple minutes (based on traffic volume) to start printing out packets.
import pcapy
sniffer = pcapy.open_live('en0', 65536 , 1 , 0)
while True:
# Grab the next header and packet buffer
header, raw_buf = sniffer.next()
print header
So the feature request is to return as soon as you get a packet (not wait for some pcap buffer to fill up.. or whatever is causing the long delay before starting...).
Version info:
- Mac Sierra 10.12.4
- libpcap = 1.8.1
from pcapy.
On further inspection of the code and issue#572, it looks like pcapy is unable to implement the changes that I'm looking for. In Linux, the libpcap library in 1.8.1 has a slightly different behavior when it comes to the use of the timeout parameter in open_live() function. In the older version, the timeout would force the next() function to wait until it received a packet for the timeout value from open_live().
What I did realize was that the open_live() function create cap object and activates it. You can't set the immmediate flag once a cap object is active so the solution to my problem can't be solved with pcapy.
from pcapy.
@csavoie it's clear at this point that you have a different issue/feature request, so perhaps open another issue for that. I'd like to keep this feature request focused on this particular requested feature, basically an immediate return when a packet arrives.
from pcapy.
If you want libpcap to deliver packets as soon as they arrive, you have to turn on immediate mode, and, in the general case, that means using pcap_create()
and pcap_activate()
to open a device on which to capture, with a call to pcap_set_immediate_mode()
between those two calls. It can't be done if you're using pcap_open_live()
to open the device - on Linux, you can't do immediate mode with TPACKET_V3, and changing from TPACKET_V3 to TPACKET_V2 involves almost as much work as closing a device and re-opening it, so we require that immediate mode be specified before we set up the TPACKET ring buffer, and there are no arguments to pcap_open_live()
available to indicate that.
So, if you want an immediate return when a packet arrives, and want to support that in a portable fashion, you'll either need to export pcap_create()
, pcap_activate()
, and the routines called between those two calls to Python callers or you'll need to export APIs that use them.
(As for the timeout, libpcap has never guaranteed, in its API contract, that the timeout is guaranteed to trigger before any packets have arrived; whether it triggers before any packets have arrived depends on the OS (libpcap being a wrapper around the very-different capture mechanisms on different OSes) and, in the case of Linux, it also depends on the kernel version.)
from pcapy.
Related Issues (20)
- error LNK2001
- Making pcapy.html browsable on Github HOT 1
- Installation failing with pcapy 0.11.2 HOT 2
- Support monitor mode HOT 1
- Make pcapy Reader object selectable
- No support for A band/5 Ghz channels
- Tests fail on python 3.7 HOT 1
- On windows findalldevs() returns unintelligible results HOT 7
- Activate returns a warning/error code integer
- nanosecond timestamp precision and packet trailers in pcapy.dumper HOT 2
- pip3 install pcapy==0.11.4 failed HOT 2
- Capture only incoming packets
- pcapy 0.11.5 missing from PyPI HOT 1
- dispatch not working HOT 1
- pcap_open_offline_with_tstamp_precision support
- Error when building HOT 2
- Not working on Python3.10 HOT 3
- 0.11.5: test suite is failing HOT 1
- AttributeError: module 'distutils.sysconfig' has no attribute '_init_posix'
- distutils module is deprecated and will be removed in Python 3.12 HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from pcapy.