Scapy ignoring filter argument to sniff() function

[nyov]

Reopening bitbucket issue nr. 747, https://bitbucket.org/secdev/scapy/issues/747/scapy-ignoring-filter-argument-to-sniff

Scapy seems to ignore the filter argument to sniff() in my installation, scapy 2.3.2 on debian.

I believe I can exclude tcpdump from being the issue as I moved it out of the way for this test, using an offline pcap file:

In [1]: from scapy.all import *
WARNING: Failed to execute tcpdump. Check it is installed and in the PATH

In [2]: pkts = sniff(offline="/tmp/some.pcap", filter="udp and host 7.7.7.7", prn=lambda x: x.summary())
Ether / IP / TCP 192.5.XXX.XXX:33658 > 85.XX.XX.XX:8020 S
Ether / IP / TCP 85.XX.XX.XX:8020 > 192.5.XXX.XXX:33658 SA
...

As can be seen, the udp filter is ignored while listing all kinds of other packets (tcp, icmp etc., any source or destination).

[p-l-]

First of all, please update to Scapy's latest version when reporting issues.

Tcpdump is actually used to install the PCAP filter, that's why Scapy needs it.

Can you try again with Tcpdump installed and using the latest version? Thanks

[nyov]

Well certainly I have tried this the usual way first (with tcpdump).

And I don't necessarily see the point of running the latest version (which is 2.3.3, one point release later?) but here is the same running git master:

$ ./run_scapy 
INFO: Can't import PyX. Won't be able to use psdump() or pdfdump().
INFO: Can't import python ecdsa lib. Disabled certificate manipulation tools
WARNING: Combined crypto modes not available for IPsec (pycrypto 2.7a1 required).
Welcome to Scapy (2.3.3.dev61)
>>> pkts = sniff(offline="/tmp/some.pcap", filter="udp and host 7.7.7.7", prn=lambda x: x.summary())
Ether / IP / TCP 192.5.XXX.XXX:33658 > 85.XX.XX.XX:8020 S
Ether / IP / TCP 85.XX.XX.XX:8020 > 192.5.XXX.XXX:33658 SA
Ether / IP / TCP 192.5.XXX.XXX:33658 > 85.XX.XX.XX:8020 A
...

[p-l-]

The point is to avoid trying to fix an issue if it has already been fixed, so that's perfect if you've been able to reproduce the issue with current Git master. For tcpdump, that was not clear in your initial message, so I had to ask, sorry about that (since testing without tcpdump does not make any sense, really).

[p-l-]

Could you check the patch from #394 and let us know if it works for you?

[nyov]

Sorry, that was rude of me.
I assumed changes between point releases would be slight and fixes memorable.

Thank you for the work, I'll check out the patch (looks good).

[scherma]

Looking forward to seeing this in stable release! Just downloaded 2.4.0rc5 and glad to see it's working there :)

[inBleakmidwinter]

i want to filter broadcast file in destination from the offline pcap file.?
is there any command

[inBleakmidwinter]

or a specific file in Destination?