def compile_filter ( bpf_filter , iface = None ) : if not TCPDUMP : raise Scapy_Exception ( "tcpdump is not available. Cannot use filter !" ) try : process = subprocess . Popen ( [ conf . prog . tcpdump , "-p" , "-i" , ( conf . iface if iface is None else iface ) , "-ddd" , "-s" , str ( MTU ) , bpf_filter ] , stdout = subprocess . PIPE , stderr = subprocess . PIPE ) except OSError as ex : raise Scapy_Exception ( "Failed to attach filter: %s" % ex ) lines , err = process . communicate ( ) ret = process . returncode if ret : raise Scapy_Exception ( "Failed to attach filter: tcpdump returned: %s" % err ) lines = lines . strip ( ) . split ( b"\n" ) return get_bpf_pointer ( lines )
scapy python apply filter to pcap and export new file
Asks Tcpdump to parse the filter then build the matching BPF bytecode using get_bpf_pointer .
def compile_filter(bpf_filter, iface=None):
    """Asks Tcpdump to parse the filter, then build the matching
    BPF bytecode using get_bpf_pointer.
    """
    if not TCPDUMP:
        raise Scapy_Exception("tcpdump is not available. Cannot use filter !")
    try:
        process = subprocess.Popen([
            conf.prog.tcpdump,
            "-p",
            "-i", (conf.iface if iface is None else iface),
            "-ddd",
            "-s", str(MTU),
            bpf_filter],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE
        )
    except OSError as ex:
        raise Scapy_Exception("Failed to attach filter: %s" % ex)
    lines, err = process.communicate()
    ret = process.returncode
    if ret:
        raise Scapy_Exception(
            "Failed to attach filter: tcpdump returned: %s" % err
        )
    lines = lines.strip().split(b"\n")
    return get_bpf_pointer(lines)