https://github.com/activecm/sniffer-template

Template for building a packet sniffer
https://github.com/activecm/sniffer-template

pcap pcap-analyzer pcap-files pcap-library python python3 scapy template

Last synced: 3 months ago
JSON representation

Template for building a packet sniffer

• Host: GitHub
• URL: https://github.com/activecm/sniffer-template
• Owner: activecm
• License: gpl-3.0
• Created: 2022-02-18T15:42:01.000Z (almost 3 years ago)
• Default Branch: main
• Last Pushed: 2024-03-25T23:21:27.000Z (10 months ago)
• Last Synced: 2024-03-26T00:29:02.081Z (10 months ago)
• Topics: pcap, pcap-analyzer, pcap-files, pcap-library, python, python3, scapy, template
• Language: Python
• Homepage:
• Size: 24.4 KB
• Stars: 9
• Watchers: 5
• Forks: 3
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# sniffer-template

Template for building a packet sniffer

This is a ready-to-go base for building your custom packet sniffer.

# Steps

- Make sure python3 and scapy are installed

- Copy this script to your script name

- Edit any sections marked "REPLACEME".  This will include the trivial "...description='__sniffer_template version '..." and the processpacket function

# processpacket

- "processpacket" is handed each sniffed packet one at a time as the object "p".

- Scapy has already identified the headers in the packet.  To see what's been identified, run "p.show()"

- The lines that are currently in processpacket are examples, and can be deleted.

- You can:

	1. Print information about each packet

	2. Collect statistics on the entire packet stream

	3. Save some packets to an output file

	4. Do a test (like "if p.haslayer(TCP) and p[TCP].dport == 443:") and process those differently

# Features

- Can sniff from an interface, one or more pcap files, or stdin.

- If reading from stdin, it saves all packets to a file and processes that, so it's not processing them live.

- Automatically decompresses gzip and bzip2 compressed pcap files.

- Code is in place to save packets that you feel should be saved

# Requirements

Scapy

Python3