Python Sockets: receive udp packets any destination

Question

I want to code a packet analyzer with python running on an raspberry pi. It should analize OSC (open sound control) and Art-Net (stage lighting protocol). Both are UDP packets - I use the following code, found here: http://www.binarytides.com/python-packet-sniffer-code-linux

import socket
s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_UDP)

while True:
    print s.recvfrom(65565)

Everything works fine, if the desination ip is the ip of the raspberry pi. I want to receive all udp traffic in the network, also packets not addressed to the raspberry pi to show also packets send by servers to another client.

What can I change here to do that?

Answer 1

Sniffing a network is a bit different from sniffing data incoming to a single machine. Sniffing a network unfortunately may require some infrastructural changes and has little to do with coding (your code will still be useful without large modifications).

Observing Ethernet network

A couple of terms you need to know here: collision domain , broadcast domain . If your whole network is in the same collision domain, just add a sniffer to the network and you should be able to observe the packets (at least with wireshark, not sure about the code you posted).

Collision domains are untouched by ehternet hubs . Collision domains are separated by active network equipment ( routers and switches ). Broadcast domains are separated by routers or by switches between VLAN s. Being in a separate collision domain means you won't see point-to-point datagrams. Being in in different broadcast domains means you won't see broadcast and multicast datagrams.

If the whole network is connected to a single switch, you can setup port mirroring here. It copies traffic from one ehternet switch port (please note it's physical port, not a TCP/UDP one) to another in addition to basic switching process. For Cisco devices the technology is called SPAN .

Multiple switches + routers topology may require setting multiple SPANs across the equipment. If you have a single machine that orchestrates the lighting you may want to place sniffer there. Again, collecting network traffic requires architectural decisions.

Observing wireless network

This can be simpler because such a network always has single collision domain, so you can just get the packets from the air. But this openness also made wireless protocols more secure by default. So if the network uses a secure hotspot, there's probably no chance to sniff without committing unethical things. However, a hotspot is a router, and this router may be wired-connected to some switch. Here you can use port mirroring again.