Python3 sniffer problem in mac, why it doesn't work?

Question

I am new to socket programming and I wrote this very short python3 code on mac and run. It can only sniff ping messages. When I open my Chrome and visit www.google.com it won't receive anything.

It's my code problem or a problem of macOS? And please help me with a correct version of python3 code.

import socket

sniffer = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_ICMP)
sniffer.bind(('', 0))

sniffer.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)
while True:
    print(sniffer.recvfrom(4096))

I've also tried replacing IPPROTO_ICMP with IPPROTO_IP and IPPROTO_TCP. None works.

I think that `socket.IPPROTO_ICMP` is the culprit. You only ask for ICMP protocol and only see ping requests. You should have better results with `IPPROTO_IP`. — Serge Ballesta, Mar 25 '21 at 07:26
@SergeBallesta Thank you! But I've tried ```IPPROTO_IP``` as well as ```IPPROTO_TCP```. None works. So it may be a problem of macOS? — maxhsia, Mar 25 '21 at 07:35
Accessing raw sockets like that ofter requires administrator privileges... Unsure whether related. — Serge Ballesta, Mar 25 '21 at 07:48
@SergeBallesta I used sudo as admin. I've run it on a linux virtual machine and it worked fine. Now I wonder how to make it work on macOS. — maxhsia, Mar 25 '21 at 07:58
Sorry I do not use MacOS and I won't be able to help you here... — Serge Ballesta, Mar 25 '21 at 08:00

score 0 · Answer 1 · answered May 29 '22 at 11:14

0

I met a similar problem like yours when I was programming in C on MacOS

Strange RAW Socket on Mac OS X says that almost all the packets, registered in kernel(including TCP), won't pass rock sockets. So, you can have a try to pcap in Python.

answered May 29 '22 at 11:14

Frank OU

41
2

Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community May 29 '22 at 19:02
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - [From Review](/review/late-answers/31890560) – Emi OB Jun 01 '22 at 08:00

Python3 sniffer problem in mac, why it doesn't work?

1 Answers1