Answer the question
In order to leave comments, you need to log in
How to run spacy in cooked mode?
Hello.
There is a task to capture traffic from the machine. As a solution, I use scapy.
The host is configured with two interfaces ethX and tunelX ( tunnel )
It turned out that tcpdump captures all packets by filter, but scapy does not.
After a little investigation, we found out. tcpdump, if interface "any" is specified, runs in 'cooked mode', which means it will create a socket of type SOCK_DGRAM. This is necessary, because in "tunnel packets" some information in the link-layer may be missing or partially present, which may not allow determining the type of the packet.
Indeed, if you run strace on a scapy script, you can see that packets arrive at the socket, but are not captured.
927689 recvfrom(3, "..some-data..."..., 65535, 0, {sa_family=AF_INET6, sin6_port=htons(53), inet_pton(AF_INET6, "...some address...", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, [28]) = 105
927689 recvfrom(3, "..some-data..."..., 32767, 0, {sa_family=AF_PACKET, proto=0x86dd, if4, pkttype=PACKET_HOST, addr(6)={1, 30d17e75727f}, [18]) = 246
927689 recvfrom(3, "..some-data..."..., 32767, 0, {sa_family=AF_PACKET, proto=0x86dd, if4, pkttype=PACKET_HOST, addr(6)={1, 30d17e75727f}, [18]) = 86
927689 recvfrom(3, "..some-data..."..., 32767, 0, {sa_family=AF_PACKET, proto=0x86dd, if4, pkttype=PACKET_HOST, addr(6)={1, 30d17e75727f}, [18]) = 86
927689 recvfrom(3, "..some-data..."..., 32767, 0, {sa_family=AF_PACKET, proto=0x86dd, if4, pkttype=PACKET_OUTGOING, addr(6)={1, 90e2ba55f6e8}, [18]) = 271
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question