Python - tcpdump subprocess hangs

Question

Probably a simple fix regarding subprocesses but I can't work out what's going wrong.

I have a small list of webpages for which I want to packet capture. I want one pcap file per webpage. I'm using tcpdump and phantomJS . Here's the relevant part of the code:

from selenium import webdriver
..more imports here..

URLs = ['https://webpage1.com', 'https://webpage2.com', etc.]

driver = webdriver.PhantomJS(executable_path='/usr/bin/phantomjs', port=65000)
driver.set_window_size(1024, 768)

def Crawler():
    for eachHost in URLs:
        print '\n* Capturing in-progress.'
        print '* Host: ', eachHost
        try:
            handle = subprocess.Popen(['sudo', 'tcpdump', '-w', str(eachHost) + '.pcap'], stdout=subprocess.PIPE)

            driver.get(eachHost)
            time.sleep(5)
            driver.close()

            time.sleep(2)
            handle.terminate()
            print '* tcpdump killed.'

        except:
            print '* Exception caught.'
            sys.exit(0)
    sys.exit(0)

What i expect it to do : capture first 5 seconds of each page load and put in to separate pcaps

What it does : prints the below in my terminal and then hangs, capturing but not terminating, and not cycling to the next webpage.

Host:  https://www.webpage1.com/
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

Answer 1

I think the reason you can't terminate the child process is because you're starting the process using the sudo command. Because tcpdump is then running as the root user, you can't just terminate it as a regular user.

I just tried testing locally. After starting tcpdump:

$ ps ax | grep tcpdump
62410 s007  S+     0:00.01 sudo tcpdump
62420 s007  S+     0:00.05 tcpdump
62540 s008  S+     0:00.00 grep tcpdump
$ kill -15 62410
-bash: kill: (62410) - Operation not permitted
$ kill -15 62420
-bash: kill: (62420) - Operation not permitted

I don't know of a way to execute a sudo kill/terminate command without forking another process (eg, via subprocess ), so I would have to get the tcpdump process id ( pid ) using handle.pid and call subprocess.Popen(['sudo', 'kill', '15', <pid>]) .

Answer 2

I think that your subprocess call is blocking thats why you can't stop it. Try using multiprocessing and throw the tcpdump command into a thread.