tcpdump check error in centos

[abc19899]

Brief description

I have installed tcpdump in PATH, but it reports:
scapy.error.Scapy_Exception: tcpdump is not available. Cannot use filter !
I found the code which check tcudmp in /opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/scapy/arch/common.py:

def _check_tcpdump():
    """
    Return True if the tcpdump command can be started
    """
    with open(os.devnull, 'wb') as devnull:
        try:
            proc = subprocess.Popen([conf.prog.tcpdump, "--version"],
                                    stdout=devnull, stderr=subprocess.STDOUT)
        except OSError:
            return False
    return proc.wait() == 0

the error is that tcpdump --version return 1 instead of 0
eg:

[root@localhost proxy]# tcpdump --version
tcpdump version 4.1-PRE-CVS_2017_03_21
libpcap version 1.4.0
Usage: tcpdump [-aAdDefhIJKlLnNOpqRStuUvxX] [ -B size ] [ -c count ]
		[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]
		[ -i interface ] [ -j tstamptype ] [ -M secret ]
		[ -Q|-P in|out|inout ]
		[ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
		[ -W filecount ] [ -y datalinktype ] [ -z command ]
		[ -Z user ] [ expression ]
[root@localhost proxy]# echo $?
1

Environment

[root@localhost proxy]# python3.6 --version
Python 3.6.3
[root@localhost proxy]# pip3.6 freeze
certifi==2018.11.29
chardet==3.0.4
idna==2.8
protobuf==3.6.1
psutil==5.4.8
PyMySQL==0.9.3
redis==3.0.1
requests==2.21.0
s8-protocol==1.0
scapy==2.4.2
six==1.11.0
snakeMQ==1.6
urllib3==1.24.1
virtualenv==15.1.0
xlrd==1.2.0
You are using pip version 9.0.1, however version 19.0.2 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
[root@localhost proxy]# uname -a
Linux localhost.localdomain 2.6.32-431.el6.x86_64 #1 SMP Fri Nov 22 03:15:09 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost proxy]# cat /etc/issue
CentOS release 6.5 (Final)
Kernel \r on an \m

[gpotter2]

Hi !
This was fixed by 1515cbb

Please use the development build (github)

(Feel free to reopen if you think that’s not it)

[MaoJianwei]

I also met this problem now, using master branch.

File "/usr/lib/python2.7/site-packages/scapy-git_archive.devbe4ff41e3-py2.7.egg/scapy/sendrecv.py", line 1020, in sniff
sniffer._run(*args, **kwargs)
File "/usr/lib/python2.7/site-packages/scapy-git_archive.devbe4ff41e3-py2.7.egg/scapy/sendrecv.py", line 890, in _run
*arg, **karg)] = iface
File "/usr/lib/python2.7/site-packages/scapy-git_archive.devbe4ff41e3-py2.7.egg/scapy/arch/linux.py", line 475, in init
attach_filter(self.ins, filter, iface)
File "/usr/lib/python2.7/site-packages/scapy-git_archive.devbe4ff41e3-py2.7.egg/scapy/arch/linux.py", line 160, in attach_filter
bp = compile_filter(bpf_filter, iface)
File "/usr/lib/python2.7/site-packages/scapy-git_archive.devbe4ff41e3-py2.7.egg/scapy/arch/common.py", line 164, in compile_filter
raise Scapy_Exception("tcpdump is not available. Cannot use filter !")
scapy.error.Scapy_Exception: tcpdump is not available. Cannot use filter !
Exception socket.error: error(99, 'Cannot assign requested address') in <bound method L2ListenSocket.del of <scapy.arch.linux.L2ListenSocket object at 0x2b0e810>> ignored

[MaoJianwei]

I add two 'print', and I can show you the result as follow:

so I think this may be a bug :)

---

def _check_tcpdump():
    """
    Return True if the tcpdump command can be started
    """
    try:
        proc = subprocess.Popen(
            [conf.prog.tcpdump, "--version"],
            stdout=subprocess.PIPE,
            stderr=subprocess.STDOUT
        )
        output = proc.communicate()[0]
    except OSError:
        return False

    # On some systems, --version does not exist on tcpdump
    print proc.returncode
    print output
    return proc.returncode == 0 or output.startswith(b'Usage: tcpdump ')

---

1
tcpdump: unrecognized option '--version'
tcpdump version 4.5.1
libpcap version 1.5.3
Usage: tcpdump [-aAbdDefhHIJKlLnNOpqRStuUvxX] [ -B size ] [ -c count ]
                [ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]
                [ -i interface ] [ -j tstamptype ] [ -M secret ]
                [ -P in|out|inout ]
                [ -r file ] [ -s snaplen ] [ -T type ] [ -V file ] [ -w file ]
                [ -W filecount ] [ -y datalinktype ] [ -z command ]
                [ -Z user ] [ expression ]

---

[MaoJianwei]

After I change

return proc.returncode == 0 or output.startswith(b'Usage: tcpdump ')

to

return True

, Scapy is running like a happy child :)

Thanks to @abc19899 for your clues!

[gpotter2]

@guedou please have a look. I got the ping

[MaoJianwei]

Thanks @gpotter2 and @guedou , I have submitted a pull request.

Could you please review this commit, and give me some advice? :)

Pull request: #2255