Impacket sniffer.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”Receives IP packets through raw sockets without libpcap and displays them with Impacket decoders.
| Item | Details |
|---|---|
| Implementation | examples/sniffer.py |
| Category | Packets / ICMP / capture |
| Size | 80 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”This older sample does not handle -h. Check its usage message and top-level sys.argv handling.
python examples/sniffer.py [protocol ...]socket.getprotobyname() converts protocol names to numbers, and the script creates
one raw IPv4 socket per protocol. With no arguments, it uses icmp, tcp, and udp.
Unknown protocol names are ignored after a warning.
Detailed processing flow
Section titled “Detailed processing flow”The script creates raw sockets and waits for data with select. It passes received datagrams to the IP decoder, displays their hierarchy, and continues the loop. Raw socket protocols and received headers differ by OS.
How it works
Section titled “How it works”This sample opens one IPv4 raw socket per protocol number without using libpcap.
It converts arguments such as icmp, tcp, and udp to IP protocol numbers with
getprotobyname(), and uses IP_HDRINCL to include IPv4 headers in received data.
It skips unknown names without creating sockets.
The main loop passes multiple sockets to select and reads datagrams from sockets
that become ready. Assuming they all include IPv4 headers, it uses IPDecoder.
Child decoders build the packet hierarchy based on the protocol field. Although
the sockets are separated by protocol, decoding and display follow the same path.
There is no BPF filter, interface selection, promiscuous mode, or pcap timestamp. The packets delivered by a raw socket vary by OS, and administrator privileges are needed. Unless short packets and decoder exceptions are isolated individually, one malformed packet can stop the entire sniffer.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
| module-level entry | 1 | Parses arguments and runs at the top level |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket | ImpactDecoder |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- Performs network probing or live packet capture. Check the send and receive scope, interface, filters, and handling of captured data.
- Starts a listening socket or long-running loop. Check the bind address, port, stop method, and shared state across concurrent connections.
- Raw socket or packet capture privileges may be required. Captured data may include third-party traffic.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- Ensure stop requests, client disconnections, partial reads or writes, and worker exceptions do not leave the listener in an inconsistent state.
When changing the implementation
Section titled “When changing the implementation”The code uses only ImpactDecoder and the standard socket/select modules. It has no argument parser or classes; when extending it, first expose interface, filter, and exit conditions in the CLI. Administrator privileges are normally required.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/sniffer.py - CLI: Use a subprocess to check the usage message and exit code with no or too few arguments.
- No test specific to this command was found. Choose shared-module tests and, if needed, a run in an isolated environment.