«

Hello, I thought I'd write a program to collect information from pf
(packet filter) and insert it into a postgresql database for review on a
web page. First I checked if this has been done already, and found that
it has.. Using Perl and SQLite in a program called "hatchet".

Well, I want to do it in Python, and I want to use postgresql.

Anyway, upon looking in the hatchet Perl code I found this:

open(IN, "$tcpdump -neltttr $log 2>&1 |");

That looks kind of funky... And if I'm reading it correctly, the Perl
script's process starts tcpdump, but redirects its output to its own
input, and reads it line by line.

I would normally have done it like this:

$ tcpdump -nelttt pflog0 | mypythonscript.py

...however, the Perl script solution looks interresting.. Is it
possible to do something like that in Python?

--
Kind Regards,
Jan Danielsson
Te audire non possum. Musa sapientum fixa est in aure.

On 2006-01-23, Jan Danielsson <> wrote:

> And if I'm reading it correctly, the Perl
> script's process starts tcpdump, but redirects its output to its own
> input, and reads it line by line.
[...]
> ...however, the Perl script solution looks interresting.. Is it
> possible to do something like that in Python?

os.popen()

http://www.python.org/doc/current/lib/os-process.html


--
Grant Edwards grante Yow! Yow! I threw up on
at my window!
visi.com

On 2006-01-23, Grant Edwards <> wrote:
> On 2006-01-23, Jan Danielsson <> wrote:
>
>> And if I'm reading it correctly, the Perl
>> script's process starts tcpdump, but redirects its output to its own
>> input, and reads it line by line.
> [...]
>> ...however, the Perl script solution looks interresting.. Is it
>> possible to do something like that in Python?
>
> os.popen()
>
> http://www.python.org/doc/current/lib/os-process.html

I should have also added that there's a module that allows you
to call libpcap directly (libpcap is the library that tcpdump
uses to capture packets).

http://sourceforge.net/projects/pylibpcap/

It's way, way more efficient than parsing tcpdump's output. If
you're only grabbing a few packets it may not matter. For some
of the apps I've done, using pylibpcap has cut run-times by a
factor of 10 or more.

--
Grant Edwards grante Yow! Life is selling
at REVOLUTIONARY HAIR
visi.com PRODUCTS!

>>> And if I'm reading it correctly, the Perl
>>> script's process starts tcpdump, but redirects its output to its own
>>> input, and reads it line by line.

And to clarify, what the Perl script is doing is redirecting the standard
error to standard out. STDIN is file handle 0, STDOUT is file handle 1,
and STDERR is file handle 2.