Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Scapy filtering with sniff() function

Tags:

python

scapy

I'm using scapy function sniff() for packet capturing. I want to capture only EAP packets. I can filter EAP packets with tcpdump with following filter:

# tcpdump -i mon0 -p ether proto 0x888e
tcpdump: WARNING: mon0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on mon0, link-type IEEE802_11_RADIO (802.11 plus radiotap header), capture size 65535 bytes
13:04:41.949446 80847234901us tsft 48.0 Mb/s 2437 MHz 11g -16dB signal antenna 1 [bit 14] EAP packet (0) v1, len 5
13:04:46.545776 80851831746us tsft 54.0 Mb/s 2437 MHz 11g -13dB signal antenna 1 [bit 14] EAP packet (0) v1, len 5

At the same time I have sniff() function running with the same filter, but function doesn't capture any EAP packets:

sniff(filter="ether proto 0x888e",iface="mon0", count = 1)

Why sniff() function doesn't capture any EAP packets?

EDIT:

Sorry for my late reaction, I tried what you proposed:

> conf.iface = 'mon0'
> pkts = sniff(filter="wlan proto 0x888e", count = 1)
tcpdump: WARNING: mon0: no IPv4 address assigned
> pkts
Sniffed: TCP:0 UDP:0 ICMP:0 Other:1
> EAP in pkts[0]
False 

But this does not still capture EAP packet :(

like image 850
Karel Marhoul Avatar asked Jan 18 '23 13:01

Karel Marhoul


1 Answers

I know this is over a year later, but for the benefit of anyone else looking at this question the answer is that he captured EAPOL packets, not EAP packets. By using the command

sniff(filter="ether proto 0x888e", count=4)

0x888e refers to EAPOL in ethernet protocol, which requires the use of the ether proto, not the wlan proto. I'm not sure if 0888e can be referred to anything in wlan proto, but after doing almost the identical thing as the op (except replacing 'wlan' with 'ether') I got

>>> EAP in b[0]
False

However when I enter

>>> EAPOL in b[0]
True

I believe OP captured what his code was looking for (2 EAPOL packets), but he didn't capture what he thought he was looking for - 2 EAP packets.

Edit - Even when I replace ether with wlan I still come up with EAP as false and EAPOL as true.

like image 132
Cerberus136 Avatar answered Jan 28 '23 20:01

Cerberus136