CODEWITHSUNDEEP
pythonhttpsniffer
Aviv
Aviv

Reputation: 466

How to sniff HTTP packets in python?

I want to sniff all the HTTP packets in my computer via python(version2.6.. is this possible? can I do it with scapy, or without other external modules?

Upvotes: 17

Views: 36928

Answers (4)

Cukic0d
Cukic0d

Reputation: 5411

FTR, Scapy will support HTTP packets starting from 2.4.3: https://scapy.readthedocs.io/en/latest/layers/http.html

>>> HTTPRequest().show()
###[ HTTP Request ]###
  Method= 'GET'
  Path= '/'
  Http_Version= 'HTTP/1.1'
  A_IM= None
  Accept= None
  Accept_Charset= None
  Accept_Datetime= None
  Accept_Encoding= None
  [...]

Sniff demo:

from scapy.layers.http import * # read the doc
from scapy.sendrecv import sniff
sniff(lfilter=lambda x: HTTP in x, prn=lambda x: x.summary())

Upvotes: 0

ife
ife

Reputation: 1461

https://github.com/KimiNewt/pyshark

Python wrapper for tshark

Usage:

>>> capture = pyshark.LiveCapture(interface='eth0')
>>> capture.sniff(timeout=50)
>>> capture
<LiveCapture (5 packets)>
>>> capture[3]
<UDP/HTTP Packet>

for packet in capture.sniff_continuously(packet_count=5):
    print 'Just arrived:', packet

Upvotes: 3

Dave Hite
Dave Hite

Reputation: 313

Scrapy is only for extracting data from webpages or similar structured documents.

To actually read the packets coming from the NIC your best performance option would probably be to use a C/C++ API that has python bindings.

For example WireShark has a Python API.

Pcapy is a module for packet capture using libpcap.

LibPCAP is the packet capture library written for TCPDUMP and also used in WireShark.

Another option is to try the dpkt python module. Here is a nice write up. Here's an example using using dpkt and pcap to sniff HTTP packets.

EDIT: oops, I misread scapy. Thanks root!

As you mentioned, Scapy is another python module that also uses LibPCAP. This documentation has an example of sniffing.

If you are having trouble running on Python 2.7 check out this post.

Upvotes: 7

pigletfly
pigletfly

Reputation: 1081

pypcap,https://code.google.com/p/pypcap/ simplified object-oriented Python extension module for libpcap - the current tcpdump.org version, the legacy version shipping with some of the BSD operating systems, and the WinPcap port for Windows.This is a Windows version.And if you are using #nix,just install pcap and dpkt module.

Upvotes: 2

Related Questions