Python sniffer using pypcap and dpkt on OS X

Question

I'm actually trying to sniff packets with python (using pypcap and dpkt).

I tried the following :

import dpkt, pcap
pc = pcap.pcap()     # construct pcap object
pc.setfilter('src host X.X.X.X or dst host X.X.X.X')
for timestamp, packet in pc:
    print dpkt.ethernet.Ethernet(packet)

But nothing happens when I launch the script... Did I miss something ?

Using Python 2.7 On OS X Yosemite (10.10)

Answer 1

If you didn't place the path to a file in pcap.pcap(), there's no pcap for it to parse.

I ran your script with a glob of from a pcap directory I have and replaced the IP with one in my network, seemed like it worked. You sure you installed pypcap and dpkt?

Here's exactly what I did with your script.

import dpkt, pcap, glob
for i in glob.glob("/pcap/*.pcap"):
    pc = pcap.pcap(i)
    pc.setfilter('src host 192.168.1.140 or dst host 192.168.1.140')
    for timestamp, packet in pc:
        print dpkt.ethernet.Ethernet(packet)

It printed a lot of stuff.