Handling tcpdump output in python

Question

Im trying to handle tcpdump output in python.

What I need is to run tcpdump (which captures the packets and gives me information) and read the output and process it.

Answer 1

You can make tcpdump line-buffered with "-l". Then you can use subprocess to capture the output as it comes out.

import subprocess as sub

p = sub.Popen(('sudo', 'tcpdump', '-l'), stdout=sub.PIPE)
for row in iter(p.stdout.readline, b''):
    print row.rstrip()   # process here

Answer 2

By default, pipes are block buffered and interactive output is line buffered. It sounds like you need a line buffered pipe - coming from tcpdump in a subprocess.

In the old days, we'd recommend Dan Bernstein's "pty" program for this kind of thing. Today, it appears that pty hasn't been updated in a long time, but there's a new program called "emtpy" which is more or less the same idea: http://empty.sourceforge.net/

You might try running tcpdump under empty in your subprocess to make tcpdump line buffered even though it's writing to a pipe.