Scapy无法捕获数据包求助：原正常程序突然失效

Let’s walk through the most common reasons your packet capture stopped working, along with actionable fixes:

1. Missing Administrative Permissions #

Scapy needs elevated privileges to access network interfaces for packet capture. This is the #1 culprit for sudden failures:

• Linux/macOS: Run your script with sudo (e.g., sudo python3 your_script.py). Without root access, Scapy can’t listen to network traffic.
• Windows: Launch your command prompt or IDE as Administrator. Right-click the app and select "Run as administrator" before executing the script.

2. Incorrect or Inactive Network Interface #

By default, Scapy might pick an interface that’s not receiving traffic (like a disconnected VPN or unused adapter). Fix this by:

• First, listing all available interfaces to identify active ones:

  from scapy.all import get_if_list
  print(get_if_list())
  

• Then explicitly specifying the active interface in the sniff function. For example:

  # Replace "eth0" with your active interface name (e.g., "Wi-Fi" on Windows)
  sniff(filter="ip", prn=action, iface="eth0")
  

3. Unreliable Packet Layer Access #

Your current code uses packet[0][1].src to retrieve the source IP, which is error-prone. This assumes the second layer is always IP, but encapsulation like VLAN tagging can break this. Instead, safely check for the IP layer first:

counter = 0
def action(packet):
    global counter
    counter += 1
    if IP in packet:
        return f'Packet #{counter}: {packet[IP].src} ==> {packet[IP].dst}'
    else:
        return f'Packet #{counter}: Non-IP packet (skipped)'

If your original code hit exceptions when non-IP packets slipped through (even with the ip filter), it would silently fail to increment the counter or show output.

4. Filter Limitations #

The ip filter only captures IPv4 packets. If most of your network traffic now uses IPv6, you’ll see zero results. Adjust the filter to include both:

sniff(filter="ip or ip6", prn=action)

Scapy uses the same BPF filter syntax as Wireshark, so you can test filters there first to confirm they work.

5. Environment or Version Changes #

If you updated Scapy or your Python environment recently, compatibility issues might be the cause:

• Reinstall Scapy to rule out corrupted files: pip uninstall scapy && pip install scapy
• Check your Scapy version: from scapy.all import __version__; print(__version__)
• Test with a minimal script to isolate the problem:

  from scapy.all import sniff, IP
  def test(pkt):
      if IP in pkt:
          print(f"{pkt[IP].src} -> {pkt[IP].dst}")
  # Capture 5 IP packets to verify basic functionality
  sniff(filter="ip", prn=test, count=5)
  

6. Firewall or Network Restrictions #

A local or network firewall might block packet capture. Temporarily disable your firewall to test if that’s the issue. Also, generate traffic manually (e.g., ping a remote server) while the script runs to ensure packets are flowing through your interface.

内容的提问来源于stack exchange，提问作者Bale