CODEWITHSUNDEEP
pythoninterfacescapy
ori
ori

Reputation: 379

Scapy - the interface of a sniffed packet

I'm sniffing with scapy 2.2 on Windows 7 with Python 2.6. Is there a way I can recognize the interface of a sniffed packet? I thought about using the mac address to identify it, but is there a way to do it with scapy?

something like this (doesn't work) - 

packet = sniff(count=1, iface='eth0')[0]
print packet.iface  # prints 'eth0'

Upvotes: 7

Views: 13237

Answers (3)

Martin Sundhaug
Martin Sundhaug

Reputation: 170

In scapy, the interface-name the packet was captured on is stored in the property sniffed_on, for example:

    packet.sniffed_on

Upvotes: 4

FitzChivalry
FitzChivalry

Reputation: 339

I hardly doubt that, mostly because the interface (a NIC, in most of the cases - unless you're talking about VMs) is not a packet property. Think about it: which protocol uses interfaces? TCP? HTTP? Ethernet?

The MAC way will work, and you can do the same using the IP address (each NIC can have its own IP, think about a router with more than one port).

In a windows machine you can view your interfaces using ipconfig (or ipconfig /all for more information like MAC address). check out this link: http://www.maketecheasier.com/view-network-adapter-details-in-windows/

Upvotes: 0

Bacara
Bacara

Reputation: 7233

The interface name 'ethX' is used on Linux world, so that for Windows I think there are different name (I didn't test Scapy under Windows), for this try to execute:

>>> ifaces
This will show how Scapy has determined the usable network interfaces on your system (and will most likely not be correct in your case). It's the bases for the Windows-specific 'show_interfaces()' command.

For more details about sniff (Scapy Docs)

Upvotes: 2

Related Questions