search

karpierz / pcap-ct

Python wrapper for the pcap library.
BSD 3-Clause "New" or "Revised" License
19 stars 4 forks source link

How can I determine the network inferface name? #1

Closed openedhardware closed 4 years ago

openedhardware commented 4 years ago

image

I tried to give Wi-Fi 4 or its GUID when calling this line, but throws an error:

sniffer = pcap.pcap(name=None, promisc=True, immediate=True, timeout_ms=50)

As you could see above, I can configure the Wi-Fi 4 to monitor mode and am able to sniff Probe Request packets on Wireshark.

Any idea?

Thanks!

karpierz commented 4 years ago

@openedhardware Sorry for delay but last days I was preparing newer version of libpcap (on which pcap-ct was strictly based). As I mentioned in the libpcap's discussion:

1.10.0b9 is ready (1.10.0b8 has been removed). From CHANGES.rst:

1.10.0b9 (2019-11-27)
---------------------
- Add support for Python 3.8.
- Drop support for Python 3.4.
- Drop support for Python 2.
- Upgrade to the latest libpcap API 1.10.0-PRE
- Establishing npcap as default backend.
- Internal npcap's dll-s have been removed due to ev. license problems.
- Add support for Linux x64:
  add internal tcpdump's libpcap.so v.1.9.1 with remote capture support.
  system's tcpdump's libpcap.so can also be used (via libpcap.libpcap.cfg).
- Setup update and cleanup.

Options in libpcap.libpcap.cfg are: For Windows:

LIBPCAP = "npcap"  # default for now # system's npcap's dlls will be used
#LIBPCAP  # system's pcap's will be used (in order: npcap's, wpcap's dlls)
LIBPCAP = "wpcap"  # internal wpcap's dlls will be used
LIBPCAP  = "<absolute path for pcap's .dll>"

For Linux:

LIBPCAP = "tcpdump" # or other no path str # default # internal tcpdump's libpcap.so will be used
#LIBPCAP  # system's libpcap.so will be used
LIBPCAP  = "<absolute path for pcap's .so>"

..so could you please upgrade your packages (pip install -U libpcap pcat-ct) and let me know if and ev. what error(s) appears? On my desk this line:

sniffer = pcap.pcap(name=None, promisc=True, immediate=True, timeout_ms=50)

does not cause any error.

PS: unfortunately I am not familiar with net details, so I doubt if I can be able to help you in domain area. I am only author of those both wrappers (libpcap, pcat-ct), but I not use it deeply/intensively but only for simple test purposes.

Thanks, Adam

openedhardware commented 4 years ago

@karpierz Thanks for your quick reply! Fortunately, I got it working with scapy library... So closing this issue now.. :)

karpierz commented 4 years ago

@openedhardware

FYI: To be sure.

Some time/years ago I'v prepared pcap-ct exactly for use with scapy because we had a problem with original https://pypi.org/project/pypcap/. So pcap-ct is strict compatible with (also current) pypcap. Also for purposes where high performance matters, both libcap and/or pcap were more accurate for out cases/purposes. Earlier scapy used only original pcap as base interface for Windows. Currently scapy uses/will be use only internal copy of winpcapy: https://github.com/secdev/scapy/pull/2057 winpcapy.py uses almost exactly same way (ctypes wrapping) as my libpcap (except that libpcap use newer libpcap's API - 1.10.0) so you are right that scapy will be good choice for you.

PS: Full discussion with @gpotter2 (one of the main maintainers of scapy) in the bottom of this page: https://github.com/karpierz/libpcap/issues/1