I'm trying to dump packets to a file captured by scapy sniff
function every 10 second to no avail.
That is possible with tcpdump like: tcpdump -s 0 -i <interface> -G 10 -w <output.pcap>
. G
flag is the rotate_seconds.
Is this achievable with scapy?
Of course it is. Have a look at the wrpcap()
documentation.
Essentially, you will simply build a callback function that receives packets and takes actions. Here's a very simple example that is not necessarily intended to be functional. (I'm writing it on the fly here) This should save a cap file every 100 packets. You would simply need to change the logic to be time based instead of packet count based.
#!/usr/bin/env python
from scapy import sniff
pendingPackets = []
baseFilename = "capture-"
totalPackets = 0
def handle_packet(packet):
pendingPackets.append(packet)
totalPackets += 1
if len(pendingPackets) >= 100:
filename = baseFilename + str(totalPackets) + ".pcap"
wrpcap(filename, pendingPackets)
pendingPackets = []
sniff(filter="ip", prn=handle_packet)
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.