Handling tcpdump output in python

Question

Im trying to handle tcpdump output in python.

What I need is to run tcpdump (which captures the packets and gives me information) and read the output and process it.

The problem is that tcpdump keeps running forever and I need to read the packet info as soon as it outputs and continue doing it.

I tried looking into subprocess of python and tried calling tcpdump using popen and piping the stdout but it doesnt seem to work.

Any directions on how to proceed with this.

import subprocess def redirect(): tcpdump = subprocess.Popen("sudo tcpdump...", stdin=subprocess.PIPE, stdout=subprocess.PIPE, shell=True) while True: s = tcpdump.stdout.readline() # do domething with s redirect()

Can you post your code so far? Thanks.

Blue Ice
– Blue Ice

2013-07-28 01:57:11 +00:00
Commented Jul 28, 2013 at 1:57 — Blue Ice
– Blue Ice, Commented Jul 28, 2013 at 1:57
you could use pseudo-tty to force line-buffered output

jfs
– jfs

2015-06-12 19:50:07 +00:00
Commented Jun 12, 2015 at 19:50 — jfs
– jfs, Commented Jun 12, 2015 at 19:50

swstephe · Accepted Answer · 2015-06-14 00:42:55Z

24

You can make tcpdump line-buffered with "-l". Then you can use subprocess to capture the output as it comes out.

import subprocess as sub p = sub.Popen(('sudo', 'tcpdump', '-l'), stdout=sub.PIPE) for row in iter(p.stdout.readline, b''): print row.rstrip() # process here

edited Jun 14, 2015 at 0:42

answered Jul 28, 2013 at 2:44

swstephe

1,91011 silver badges19 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

jfs Over a year ago

use for line in iter(p.stdout.readline, b''): print line, in Python 2 due to "readahead buffer" bug

jfs Over a year ago

for line in p.stdout: introduces unnecessary delay in the output on Python 2 (OP wants: "as soon as it outputs"). Use iter(..) as I've mentioned above. See Python: read streaming input from subprocess.communicate()

dstromberg · Accepted Answer · 2013-07-28 02:35:31Z

By default, pipes are block buffered and interactive output is line buffered. It sounds like you need a line buffered pipe - coming from tcpdump in a subprocess.

In the old days, we'd recommend Dan Bernstein's "pty" program for this kind of thing. Today, it appears that pty hasn't been updated in a long time, but there's a new program called "emtpy" which is more or less the same idea: http://empty.sourceforge.net/

You might try running tcpdump under empty in your subprocess to make tcpdump line buffered even though it's writing to a pipe.

python has pty module in stdlib. Or pexpect could be used. There are also stdbuf, script, unbuffer utilities that may force line-buffered output

Collectives™ on Stack Overflow

Handling tcpdump output in python

2 Answers 2

2 Comments

1 Comment

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Linked

Related