Python event based network sniffer

Python event based network sniffer

• 1.
  Network sniffer inPython (event-based) Jirka Vejražka (@JirkaV) @Pyvec - PyVo #20
• 2.
  Why? Because tcpdump wasnot right for the job How? pyevent + pypcap (by @dugsong)
• 3.
  The Code (Python 2.x) import pcap import event if_eth0 = pcap.pcap(‘eth0’) # needs root pcap_file = get_PCAP_file() event.read(if_eth0.fd, packets_handler, if_eth0) event.dispatch() # it all happens here print ‘All done, quitting’
• 4.
  Secret sauce? None! defget_PCAP_file(): pcap_f = open(‘packets.pcap’, ‘wb’) pcap_f.write(PCAP_HEADER) # PCAP docs return pcap_f def packets_handler(iface): for timestamp, packet in iface.readpkts(): pcap_file.write(packet) return True
• 5.
  Filtering (we don’t want it all) if_eth0 = pcap.pcap(‘eth0’) if_eth0.setfilter(‘icmp or tcp and port 80’) event.dispatch()
• 6.
  Stopping It (because a packet may never arrive) import signal def stop_sniffing(): event.loop() # handle unprocessed events event.abort() event.signal(signal.SIGTERM, stop_sniffing) event.signal(signal.SIGINT, stop_sniffing)
• 7.
  Nice to Have (statistics) def print_stats(iface): recvd, dropped, if_drops = iface.stats() print ‘received:’, recvd print ‘dropped:’, dropped return True event.signal(signal.SIGUSR1, print_stats, if_eth0) event.timeout(60*15, print_stats, if_eth0)
• 8.
  Questions? Kudos to @craigbaldingfor “rmmod perl && modprobe python” as well as the whole sniffer idea This presentation is incredibly average thanks to the Avería font from iotic.com/averia/