Search code examples
scapysniffing

Filter packets by ttl Scapy?


I need to have Scapy filter by ttl (e.g.: sniff(iface = 'eth0', filter = 'ttl 128') ) but can't seem to find the right syntax for the command to work. Is this possible?


Solution

  • I am not aware of a ttl keyword for BPF filters, you can do it like that though:

    sniff(iface = 'eth0', filter = 'ip[8] == 128')