search

karpierz / pcap-ct

Python wrapper for the pcap library.
BSD 3-Clause "New" or "Revised" License
19 stars 4 forks source link

Does pcap-ct support remote capture (rpcap) ? #2

Closed AdrianKeys closed 2 years ago

AdrianKeys commented 4 years ago

I want to capture packets of another PC with rpcapd running on it. If rpcapd is installed on a remote machine, Wireshark/Tshark can capture remote packets by replacing the local interface name with a remote interface name like "rpcap://remoteip:2002/eth0". (e.g. from "tshark -i eth0" to "tshark -i rpcap://remoteip:2002/eth0")

So I tried pcap.pcap(name="rpcap://remoteip:2002/eth0" ) but it returned with an error: "OSError: Activateing packet capture failed. Error returned by packet capture library was No such device exists" Apparently it checked if the interface is available on the local machine. However, when doing remote capture, it shouldn't check interface name locally.

I'm wondering if pcap-ct support rpcap? Is this error an issue or just my wrong way of using this lib?

( Thank you for developing such a nice and friendly python lib. pcap-ct is more convenient than other pcap based libs in terms of installation since other libs need to compile winpcap C files (such as pcap.h) so a C compiler and winpcap dev pack are needed and other libs are more difficult to migrate. )

karpierz commented 3 years ago

Sorry Adrian for such big delay. I had a break in programming. Unfortunately I am not familiar with net at all :(. My knowledge is only very basic. It it enough to create and support e.g. this module, but not for using it in deeper way. Sorry...