I am capturing packets using tcpdump for real-time processing. I'm using the IEEE_80211_RADIO headers and processing the output in a python 3 script. My invocation currently looks like this:

tcpdump -IUnSA -y IEEE802_11_RADIO -i $iface

Using -A or -x I can detect the beginning of the next packet, since the header details are distinct from the packet dump, but I can't detect the end of the current packet. Is there a way to detect the end of the current packet in this context?

(An acceptable alternative for my application is to print the packet length in the header summary and avoid printing the packet dump. This is possible using the -e or -v flags in other contexts but these don't seem to print the packet length in combination with the rest of my call.)

  • Have you considered processing the binary pcap format instead? (Or even using libpcap or scapy directly from Python?) That's what all other software does. – grawity Jan 21 '18 at 9:37
  • I had tried consuming libpcap from C but my C chops weren't up to the task, so I switched to this python / tcpdump solution. Scapy looks ideal though, so I'll that a try -- thank you for mentioning it! – dave Jan 21 '18 at 21:05

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.