Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to filter by ethernet MAC address

The following code:

sniff(filter = "dst aa:bb:cc:dd:ee" ) 

throws an error because sniff is expecting an IP, not a MAC.

So how are you supposed to filter by MAC?

like image 516
bzupnick Avatar asked Oct 01 '22 11:10

bzupnick


1 Answers

what about specyfing a lfilter for sniff ?

zzz = sniff(lfilter=lambda d: d.src == 'aa:bb:cc:dd:ee:ff')


dst and src are attributes of sniffed message.


previously i have posted an answer where stop_filter was specified. i suppose that it wouldn't work for you, since scapy would stop after receving first packet that match the mac address from stop_filter. lfilter should do the job.

from sendrecv.py:

lfilter: python function applied to each packet to determine                   
         if further action may be done                                         
         ex: lfilter = lambda x: x.haslayer(Padding)
like image 74
macfij Avatar answered Nov 01 '22 11:11

macfij