Python/Scapy: sniff only incoming packets

Question

Can I sniff only incoming or only outgouing packets in Scapy?

Without addition of filters on packet fields.

Answer 1

Short answer: no. Scapy's sniff function doesn't distinguish between incoming and outgoing packets. If you want to filter based on source mac, you can do this:

MYMAC = "12:34:56:78:90:99"

def isNotOutgoing(pkt):
    return pkt[Ether].src != MYMAC

sniff(iface="eth0", lfilter=isNotOutgoing)

Answer 2

Scapy doesn't always perform best: http://askldjd.wordpress.com/2014/01/15/a-reasonably-fast-python-ip-sniffer/

However you can definitely sniff incoming and outgoing. I am not aware of a way to take in only incoming or outgoing specifically but I believe you can filter your results. Or if you are willing to take on a larger task you can edit Scapy and create your own sniffer that only takes in one or the other.

Answer 3

sniff() supports all L2socket arguments. One such argument is filter, which takes a BPF filter http://biot.com/capstats/bpf.html . In some situations, this include the 'incoming' filter.