Python Scapy sniff without root

python-2.7 scapy sniffing linux-capabilities
Martin picture Martin · Mar 25, 2016 · Viewed 8.6k times · Source

I'm wondering if there is any possibility to run Scapy's 'sniff(...)' without root priveleges.

It is used in an application, where certain packages are captured. But I don't want to run the whole application with root permissions or change anything on scapy itselfe.

Thanks in advance!

EDIT:

For testing I use following code:

from scapy.all import *

def arp_monitor_callback(pkt):
    if ARP in pkt and pkt[ARP].op in (1,2): #who-has or is-at
        return pkt.sprintf("%ARP.hwsrc% %ARP.psrc%")

sniff(prn=arp_monitor_callback, filter="arp", store=0)

I'm only able to run it using sudo.

I tried to set capabilities with sudo setcap 'cap_net_admin=+eip' test.py. But it doesn't show any effects. Even the all capablity doesn't help.

Answer

Jeff Bencteux picture Jeff Bencteux · Apr 1, 2016

You need to set capabilities for binaries running your script i-e: python and tcpdump if you want to be able to just execute your script as ./test.py :

setcap cap_net_raw=eip /usr/bin/pythonX.X
setcap cap_net_raw=eip /usr/bin/tcpdump

Where X.X is the python version you use to run the script.

(note that path could be different on your system)

Please note that this allow anyone to open raw sockets on your system.

Related questions

Running Scapy on Windows with Python 2.7

I like to use Scapy with Python v2.7 under Windows 7. How can I install the required module pypcap for Python 2.7? Will it be possible to make Python scripts depending on Scapy into standalone Windows applications using a distribution tool such …

Read More
Fetch source address and port number of packet - Scapy script

I am doing a sniffing of the network and trying to get ip address and port number on every tcp packet. I used scapy with python and could successfully sniff packets and in a callback function could even print the …

Read More
Python: Can't import a function from another.py file

I have a file named handshake.py. Where there is a function send_data(argument). I want to import that function into another file named siptest.py. I am encountering two problems. I am using microsoft visual studio with windows 7, 64…

Read More