OSX connection sharing and Scapy

Question

I'm using Scapy to sniff network traffic with the following code:

from scapy.all import *

import sys

filter = sys.argv[1]

def Responder():

    def getPacket(pkt):
        if Raw in pkt:  print pkt[Raw]

    return getPacket

sniff(filter=filter, prn=Responder())

This code works fine if I just browse to a website.

The problem is that when I turn on connection sharing and I try to run this script I get the following error:

bash-3.2# sudo python sniffy.py "tcp port 80"
Traceback (most recent call last):
  File "sniffy.py", line 1, in <module>
    from scapy.all import *
  File "/Library/Python/2.7/site-packages/scapy/all.py", line 25, in <module>
    from route import *
  File "/Library/Python/2.7/site-packages/scapy/route.py", line 162, in <module>
    conf.route=Route()
  File "/Library/Python/2.7/site-packages/scapy/route.py", line 22, in __init__
    self.resync()
  File "/Library/Python/2.7/site-packages/scapy/route.py", line 31, in resync
    self.routes = read_routes()
  File "/Library/Python/2.7/site-packages/scapy/arch/unix.py", line 87, in read_routes
    ifaddr = scapy.arch.get_if_addr(netif)
  File "/Library/Python/2.7/site-packages/scapy/arch/__init__.py", line 36, in get_if_addr
    return socket.inet_ntoa(get_if_raw_addr(iff))
  File "/Library/Python/2.7/site-packages/scapy/arch/pcapdnet.py", line 188, in get_if_raw_addr
    return i.get(ifname)["addr"].data
  File "dnet.pyx", line 990, in dnet.intf.get
OSError: Device not configured

I tried to add "conf.iface=en1" at the top of the script. This gives the same error. en1 is a valid interface.

I've also followed the advise from here, and changed arch/unix.py on line 34 from "os.popen("netstat -rn")" to "os.popen("netstat -rn | grep -v vboxnet") ". This didn't fix it.

Answer 1

I'm running OSX 10.5.9 - spent forever trying to get scapy working - after installing dnet/pcap libraries I got the "OSError:Device not configured" too. Tried replacing line 34 in unix.py with

"netstat -rn | grep -v vboxnet"

Still got the same error. But when I change line 37 instead in the "else" part of the if block:

def read_routes():
    if scapy.arch.SOLARIS:
        f=os.popen("netstat -rvn") # -f inet
    elif scapy.arch.FREEBSD:
        f=os.popen("netstat -rnW") # -W to handle long interface names
    else:
        # f=os.popen("netstat -rn") # -f inet
        f=os.popen("netstat -rn | grep -v vboxnet") # -f inet

Works like a charm!

Answer 2

I'm running OSX 10.10.3 and have spent forever trying to get scapy to work. I tried using pip install on scapy, on scapy-real, on dnet, on dnet-real and I was still getting the same error. It was getting really frustrating, so I followed the advice of Adam B from above and thought that I would add the folder that contains the unix.py file that needs to be changed.

in /usr/local/lib/python2.7/site-packages/scapy/arch/ open unix.py using vim, nano, or another text editor.

change line 37 to be

fs=os.popen("netstat -rn | grep -v vboxnet") # -f inet

and it should work for you. I am still getting an error that python gnuplot wrapper can't be imported and that PyX can't be imported either.

Answer 3

It seems like scapy having troubles working with bridge interfaces. I got same problem and fixed it just filtering Internet share bridge interface out. In this case right fix will be replacing the same string with "netstat -rn | grep -v vboxnet | grep -v bridge"