Error in running Scapy Sniff function

Question

i wrote this program to sniff icmp packets in the network and print there source address. The code is as follows:

from scapy.all import *

def fun_callback(pkt):
    print str(pkt.payload.src)
sniff(prn = fun_callback, filter = 'icmp', timeout =5)

After running this program, I am getting this error.

[root@localhost icmp]# python test.py
WARNING: Failed to execute tcpdump. Check it is installed and in the PATH
WARNING: No route found for IPv6 destination :: (no default route?)
192.168.134.131
192.168.134.131
192.168.134.2
192.168.134.2
fe80::20c:29ff:fee4:a130
134.160.38.1
192.168.134.131
Traceback (most recent call last):
  File "test.py", line 5, in <module>
    sniff(prn = fun_callback, filter = 'icmp', timeout =5)
  File "/usr/lib/python2.7/site-packages/scapy/sendrecv.py", line 586, in sniff
    r = prn(p)
  File "test.py", line 4, in fun_callback
    print str(pkt.payload.src)
  File "/usr/lib/python2.7/site-packages/scapy/packet.py", line 176, in __getattr__
     fld,v = self.getfield_and_val(attr)
  File "/usr/lib/python2.7/site-packages/scapy/packet.py", line 172, in getfield_and_val
    return self.payload.getfield_and_val(attr)
  File "/usr/lib/python2.7/site-packages/scapy/packet.py", line 172, in getfield_and_val
    return self.payload.getfield_and_val(attr)
  File "/usr/lib/python2.7/site-packages/scapy/packet.py", line 1057, in getfield_and_val
    raise AttributeError(attr)
AttributeError: src
[root@localhost icmp]# 

Why this exception is occurring?

Answer 1

You have sniffed a packet with a payload without src attribute. If you want a quick fix for your code, write:

def fun_callback(pkt):
    if hasattr(pkt.payload, "src"):
        print str(pkt.payload.src)

The problem is, you don't really known what pkt.payload will be. If you want a better fix, try something like:

def fun_callback(pkt):
    if IP in pkt: print pkt[IP].src
    elif IPv6 in pkt: print pkt[IPv6].src

Or better, with .sprintf():

sniff(prn=lambda pkt: pkt.sprintf("{IP:%IP.src%}{IPv6:%IPv6.src%}"),
      filter='icmp', timeout=5))