filter in scapy function sniff() says libpcap is not available

user_14716441 0
Viewed 2129

I was playing around with the Scapy sniff function and I wanted to add a filter into the parameters. So I added this filter:

pkt = sniff(count=1, filter='arp')

and the output i recieve is:

WARNING: Cannot set filter: libpcap is not available. Cannot compile filter !

I still get a packet that was sniffed, but for some reason the filter is not working.

I am running Mac OS Big Sur. I have libpcap installed using Homebrew and I have tcpdump installed using Homebrew.

I also saw online that you could manually initialize pcap on Scapy using

conf.use_pcap = True

However when I type this in I get:

WARNING: No libpcap provider available ! pcap won't be used

I'm sure it is just a small fix but I can't seem to figure out what I am doing wrong. If anyone can help that would be amazing!

scapy filtering sniffing python
2 Answers

tldr:

$ brew install libpcap
$ ln -s /usr/local/opt/libpcap/lib/libpcap.a /usr/local/lib/libpcap.a
$ ln -s /usr/local/opt/libpcap/lib/libpcap.dylib /usr/local/lib/libpcap.dylib

Explanation (applicable for Python 3.9.1, Scapy 2.4.5 @ Big Sur and libpcap installed by brew):

When you debug the Scapy sniff function, after a while you get to scapy.libs.winpcapy, line 36:

_lib_name = find_library("pcap")

find_library is located in ctypes.util, for POSIX it starts on line 72. On line 73 you can see that the library is expected as one of these filenames ['libpcap.dylib', 'pcap.dylib', 'pcap.framework/pcap'], being fed to dyld_find.

dyld_find is located in ctypes.macholib.dyld on line 121. If you iter through the chain on line 125 yourself, you find out that dyld_find is trying to succeed with one of these paths:

/usr/local/lib/
/Users/<user>/lib/
/usr/local/lib/
/lib/
/usr/lib/

In my case none of them contained the libpcap lib, which is installed in different location by brew. The library sits in /usr/local/opt/libpcap/lib/. And here you go, you just need to get the file libpcap.dylib (nothing wrong with libpcap.a too) into one of those paths searched by dyld_find. The two soft links above are one of a few more possible solutions.

user_42848270

Older versions of Python 3 assume that, on macOS, all shared libraries are in files located in one of a number of directories.

That is not the case in Big Sur; instead, a cache file is generated for system shared libraries, and at least some of the libraries from which the cache file is generated are not shipped with the OS.

This is one of the issues in CPython issue 41100, "Support macOS 11 and Apple Silicon Macs"; the fix is to look in the shared library cache as well as in the file system.

That issue says

Thank you to everyone who contributed to this major undertaking! A particular thank you to Lawrence for doing much of the initial work and paving the way. Now that 3.8 also supports Big Sur and Apple Silicon Macs as of the imminent 3.8.10 release, it's time to close this issue. If new concerns arise, pleasa open or use other issues.

So a sufficiently recent version of Python should fix this issue.

user_161397390
Related