Let's start off this section with a review of the Scapy
sniff command and how it can be used very flexibly to
perform multiple capture tasks.
The Scapy sniff command can be used both at the Python terminal in a
command style or as a function within a module.
At its simplest,
the sniff command can be used to sniff all traffic coming in or out
of all locally enabled and recognized interfaces.
If used without further parameters,
the command will run in an endless loop until broken.
Usually users are looking to have some additional control
over the packets that are captured, and to meet these needs,
there are multiple parameters that can be used to alter this behavior.
The parameters that are commonly used include count,
iface, timeout, filter, lfilter, PRN, and offline.
Now let's move through what these parameters are quickly starting with count.
As the name implies,
the count parameter is used to dictate the specific number
of packets that you want to capture.
If no count is specified,
then the packet count is unlimited and the exit of the sniff
command will be based on other parameters.
The iface, or interface parameter,
is used to specify the interface that you want the
sniff command to capture from.
It is also possible to specify in multiple
interfaces should you want this behavior.
However,
it is often better to use multiple threads when performing
these actions when using Scapy as a module.
It should also be noted that as of the recording of this course,
this functionality has some issues that are being
worked through by the developers.
So if you have issues,
know that they are version specific and should be fixed soon.
Next, we have the timeout parameter.
This is used to dictate a specific amount of time to
perform the packet capture in seconds.
Sometimes you will want to use this to limit the number of packets
that are captured before further processing them.
Next, we have the filter and lfilter parameters.
Generally,
most people will end up using the filter parameter as it
uses Berkeley Packet Filters just like other capturing
programs like tcpump and Wireshark.
These will look familiar as they use keywords like src, dst, host, and port.
When using the filter parameter,
the operating system is performing the filtering before Scapy processes it,
and because of this, it is the best way to increase the performance of Scapy.
A good PDF reference for Berkeley Packet Filters is available at the link shown.
The lfilter command is used when filtering action doesn't work
or isn't available to be coded using BPF.
When using lfilter,
the filtering is done within Scapy and not outsourced to the operating system.
We then move on to the PRN parameter.
The prn parameter is used to specify a function that will
run once each packet has been captured.
When used at the CLI, it is usually matched with a Python lambda function.
When used inside a Python script, it can be extended to use full functions.
And finally, we have the offline parameter.
As we noted earlier, the sniff command is not limited to capturing live packets.
It can also be used to read in previous capture files so
that you can filter and parse on them.
Once imported into a variable, these packets can then
have multiple actions perform onto them,
including the ability to be drilled down into to find a
pattern that you are looking for.
One more thing that we are going to cover before moving into the
demonstration environment revolves around the ability to save a
list of packets that have been captured,
including those that have been captured live,
as well as previously loaded captures.
For this, the wrpcap command can be used.
This command takes two variables,
the first indicates the string name of the file that
the packets will be saved into,
and the second is the variable that holds the packet list being saved.
And so with these quickly all covered,
let's move into the demonstration environment and see
these different commands in action.