Scapy - the interface of a sniffed packet

Question

I'm sniffing with scapy 2.2 on Windows 7 with Python 2.6. Is there a way I can recognize the interface of a sniffed packet? I thought about using the mac address to identify it, but is there a way to do it with scapy?

something like this (doesn't work) -

packet = sniff(count=1, iface='eth0')[0]
print packet.iface  # prints 'eth0' 

Solution 1

I hardly doubt that, mostly because the interface (a NIC, in most of the cases - unless you're talking about VMs) is not a packet property. Think about it: which protocol uses interfaces? TCP? HTTP? Ethernet?

The MAC way will work, and you can do the same using the IP address (each NIC can have its own IP, think about a router with more than one port).

In a windows machine you can view your interfaces using ipconfig (or ipconfig /all for more information like MAC address). check out this link: http://www.maketecheasier.com/view-network-adapter-details-in-windows/

Solution 2

In scapy, the interface-name the packet was captured on is stored in the property sniffed_on, for example:

    packet.sniffed_on

Solution 3

The interface name 'ethX' is used on Linux world, so that for Windows I think there are different name (I didn't test Scapy under Windows), for this try to execute:

>>> ifaces
This will show how Scapy has determined the usable network interfaces on your system (and will most likely not be correct in your case). It's the bases for the Windows-specific 'show_interfaces()' command.

For more details about sniff (Scapy Docs)