{"id":5607,"date":"2025-05-28T09:10:38","date_gmt":"2025-05-28T09:10:38","guid":{"rendered":"http:\/\/www.examcollection.com\/blog\/?p=5607"},"modified":"2026-01-08T05:56:28","modified_gmt":"2026-01-08T05:56:28","slug":"python-thread-based-network-sniffing-with-scapy","status":"publish","type":"post","link":"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/","title":{"rendered":"Python Thread-Based Network Sniffing with Scapy"},"content":{"rendered":"<p><b><\/b><span style=\"font-weight: 400;\">Network sniffing is a foundational technique in the fields of network security, performance monitoring, and troubleshooting. By capturing and analyzing network packets, professionals gain visibility into traffic patterns, detect anomalies, and investigate potential threats. Python, with its rich ecosystem of libraries, offers powerful tools to build custom sniffing solutions. Among these tools, Scapy stands out as a versatile library designed specifically for packet manipulation and analysis.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">This article will provide a comprehensive introduction to network sniffing, explain the role and capabilities of Scapy, and discuss the benefits of incorporating threading into sniffing applications. By the end, you will understand the core concepts needed to create efficient packet sniffers in Python.<\/span><\/p>\n<h2><b>Understanding Network Sniffing<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Network sniffing refers to the process of intercepting and logging traffic that passes over a digital network. This practice is essential in many areas:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><b>Security Analysis:<\/b><span style=\"font-weight: 400;\"> Detecting intrusions, malware communication, and data exfiltration.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Network Troubleshooting:<\/b><span style=\"font-weight: 400;\"> Identifying bottlenecks, misconfigurations, and dropped packets.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Protocol Development:<\/b><span style=\"font-weight: 400;\"> Understanding and debugging new or custom protocols.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Performance Monitoring:<\/b><span style=\"font-weight: 400;\"> Tracking latency, throughput, and error rates.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">A network sniffer captures packets at various layers of the OSI model, typically focusing on Layer 2 (Data Link) or Layer 3 (Network) to capture Ethernet frames or IP packets, respectively.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Traditional sniffing tools like Wireshark provide graphical interfaces for packet capture and analysis. However, automated or programmatic sniffing is often necessary for real-time monitoring, automated alerts, or integrating sniffing into broader systems. This is where Python and Scapy come into play.<\/span><\/p>\n<h2><b>Introducing Scapy: A Pythonic Packet Manipulation Tool<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Scapy is an open-source Python library that enables users to craft, send, capture, and manipulate network packets. Unlike other packet capture libraries that mainly capture and display traffic, Scapy allows full interaction with packets at multiple protocol layers.<\/span><\/p>\n<h3><b>Key Features of Scapy<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400;\"><b>Packet Crafting:<\/b><span style=\"font-weight: 400;\"> Create packets from scratch for testing and penetration testing.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Protocol Support:<\/b><span style=\"font-weight: 400;\"> Supports many protocols, including Ethernet, IP, TCP, UDP, ICMP, and custom protocols.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Sniffing:<\/b><span style=\"font-weight: 400;\"> Capture live packets with detailed parsing.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Injection:<\/b><span style=\"font-weight: 400;\"> Send packets to the network to test devices or protocols.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Extensibility:<\/b><span style=\"font-weight: 400;\"> Easily extendable to support new protocols or features.<\/span><\/li>\n<\/ul>\n<h3><b>Installing Scapy<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">To start using Scapy, installation is straightforward using pip:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">bash<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">pip install scapy<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">Some operating systems may require additional dependencies or running the script with elevated privileges to access network interfaces.<\/span><\/p>\n<h3><b>Basic Scapy Usage for Sniffing<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">A simple way to sniff packets with Scapy is to use the sniff() function:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">from scapy.all import sniff<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">def packet_callback(packet):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0print(packet.summary())<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">sniff(prn=packet_callback, count=10)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">This script captures ten packets and prints a summary of each. The prn parameter takes a callback function executed for every captured packet.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">While this example is useful, it runs synchronously and blocks the main program until it captures the specified number of packets. For more advanced scenarios like continuous sniffing or integrating with other tasks, threading is a better approach.<\/span><\/p>\n<h2><b>Why Use Threading for Network Sniffing?<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Threading allows multiple parts of a program to run concurrently, improving efficiency and responsiveness. In network sniffing, threading is valuable for several reasons:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><b>Non-blocking Operation:<\/b><span style=\"font-weight: 400;\"> The sniffing process runs independently of the main application logic, avoiding freezes.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Real-Time Processing:<\/b><span style=\"font-weight: 400;\"> Packet capture and analysis can happen simultaneously.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Resource Management:<\/b><span style=\"font-weight: 400;\"> Allows distributing tasks such as logging, analysis, or alerting to different threads.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Multiple Interfaces or Filters:<\/b><span style=\"font-weight: 400;\"> Separate threads can sniff on different interfaces or with different filters concurrently.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Python provides the threading module, which is simple to use for starting and managing threads. Combining Scapy with Python threading creates flexible sniffers suitable for real-time network monitoring tools or automated network analysis systems.<\/span><\/p>\n<h3><b>Python Threading Basics<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">A thread is a lightweight subprocess that runs in parallel with other threads within a single process. Here is a simple example of running a function in a separate thread:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">import threading<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">def background_task():<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0print(&#8220;Task running in background&#8221;)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">thread = threading.Thread(target=background_task)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">thread.start()<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">print(&#8220;Main program continues&#8221;)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">The Thread object takes a target function and runs it independently when start() is called. The main program continues execution without waiting for the thread unless join() is used.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Using threading in sniffing scripts allows continuous packet capture without stopping the rest of the program. This approach is essential in applications requiring both packet capture and real-time user interaction or data processing.<\/span><\/p>\n<h2><b>Setting Up a Simple Threaded Sniffer with Scapy<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Before diving into advanced sniffing techniques, it is helpful to see how threading integrates with Scapy in a simple example.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">from scapy.all import sniff<\/span><\/p>\n<p><span style=\"font-weight: 400;\">import threading<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">def sniff_packets():<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0sniff(prn=lambda x: x.summary(), count=10)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">sniff_thread = threading.Thread(target=sniff_packets)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">sniff_thread.start()<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">print(&#8220;Sniffing started in a separate thread&#8221;)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">In this script:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The sniff_packets function calls Scapy&#8217;s sniff() to capture 10 packets and print summaries.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">A thread is created to run sniff_packets without blocking the main thread.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The main program immediately prints a message and can continue executing other tasks.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">This simple example demonstrates how threading helps maintain responsiveness and modularity.<\/span><\/p>\n<h2><b>Challenges in Threaded Sniffing<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Despite the advantages, threaded sniffing comes with challenges:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><b>Thread Safety:<\/b><span style=\"font-weight: 400;\"> Scapy functions may not be inherently thread-safe. Care must be taken when accessing shared data structures.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Resource Conflicts:<\/b><span style=\"font-weight: 400;\"> Multiple threads sniffing the same interface may cause packet duplication or loss.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Data Synchronization:<\/b><span style=\"font-weight: 400;\"> Passing captured packets safely between threads requires synchronization mechanisms like thread-safe queues.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Performance Overhead:<\/b><span style=\"font-weight: 400;\"> Threads consume resources, and improper management can degrade performance.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Understanding these challenges is crucial for building robust sniffers that operate reliably under heavy traffic or in complex environments.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">With a solid understanding of network sniffing fundamentals, Scapy\u2019s capabilities, and Python threading basics, you are ready to start building practical threaded sniffing tools.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The next article in this series will focus on constructing a complete threaded packet sniffer with Scapy, including filtering, callback handling, and basic packet processing. You will learn how to manage threads properly, use packet filters for efficiency, and test your sniffer on live networks.<\/span><\/p>\n<h1><b>Building a Threaded Packet Sniffer Using Scapy<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">In the first part, we introduced the concept of network sniffing, explored Scapy\u2019s capabilities, and discussed the importance of threading for creating responsive sniffing tools. This article will walk you through building a functional threaded packet sniffer in Python using Scapy.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">You will learn how to:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Utilize Python\u2019s threading module to run sniffing asynchronously<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Filter captured packets efficiently with Berkeley Packet Filter (BPF) syntax.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Handle packets with custom callback functions inside the thread.s<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Test the sniffer and interpret the output.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">By the end of this article, you will have a reusable, thread-based packet sniffer foundation to expand for various network monitoring tasks.<\/span><\/p>\n<h2><b>Recap of Key Concepts<\/b><\/h2>\n<ul>\n<li style=\"font-weight: 400;\"><b>Sniffing<\/b><span style=\"font-weight: 400;\"> captures network packets from interfaces for analysis.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Threading<\/b><span style=\"font-weight: 400;\"> allows running sniffing tasks independently without blocking the main program.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Scapy<\/b><span style=\"font-weight: 400;\"> provides packet capturing, decoding, and crafting functionalities.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>BPF filters<\/b><span style=\"font-weight: 400;\"> enable filtering traffic at the kernel level to reduce unnecessary packets.<\/span><\/li>\n<\/ul>\n<h2><b>Setting Up the Threaded Packet Sniffer<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Let\u2019s begin by writing a Python script that starts a sniffing thread to capture packets without freezing the main program. This example will include basic filtering and packet summary printing.<\/span><\/p>\n<h3><b>Step 1: Import Required Libraries<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">We need Scapy for sniffing and threading to create the sniffing thread.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">from scapy.all import sniff<\/span><\/p>\n<p><span style=\"font-weight: 400;\">import threading<\/span><\/p>\n<p>&nbsp;<\/p>\n<h3><b>Step 2: Define the Packet Handler Function<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">This function will be called every time a packet is captured. You can customize this function to analyze, log, or respond to packets.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">def packet_handler(packet):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0print(packet.summary())<\/span><\/p>\n<p>&nbsp;<\/p>\n<h3><b>Step 3: Define the Sniffing Function<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">This function wraps Scapy\u2019s sniff() and runs indefinitely (until stopped) to capture packets matching a filter.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">def sniff_packets(interface=None, filter=None, count=0):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0sniff(iface=interface, filter=filter, prn=packet_handler, count=count)<\/span><\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">iface specifies the network interface to listen on. The default listens on all.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Filter is a BPF filter string, e.g., &#8220;tcp&#8221; or &#8220;port 80&#8221;.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Count is how many packets to capture; zero means unlimited.<\/span><\/li>\n<\/ul>\n<h3><b>Step 4: Create and Start the Sniffing Thread<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Now we create a thread that runs the sniff_packets function and start it.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">def start_sniffing_thread(interface=None, filter=None, count=0):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0sniff_thread = threading.Thread(target=sniff_packets, args=(interface, filter, count))<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0sniff_thread.daemon = True\u00a0 # Allow program to exit even if thread is running<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0sniff_thread.start()<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0return sniff_thread<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">Using daemon=True means the thread won\u2019t block the program&#8217;s exit.<\/span><\/p>\n<h3><b>Step 5: Main Program Execution<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">The main program can start the sniffer thread and continue other tasks.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">if __name__ == &#8220;__main__&#8221;:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0interface = &#8220;eth0&#8221;\u00a0 # Change to your network interface<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0bpf_filter = &#8220;tcp port 80&#8221;\u00a0 # Filter HTTP traffic only<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0print(f&#8221;Starting sniffer on {interface} with filter &#8216;{bpf_filter}'&#8221;)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0thread = start_sniffing_thread(interface, bpf_filter)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0Try:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0While True:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# Main program can do other things here<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0pass<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0Except KeyboardInterrupt:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0print(&#8220;\\nStopping sniffer.&#8221;)<\/span><\/p>\n<p>&nbsp;<\/p>\n<h3><b>Explanation:<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The sniffer runs in a background thread.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The main thread stays alive to keep the program running.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Pressing Ctrl+C stops the program.<\/span><\/li>\n<\/ul>\n<h2><b>Testing Your Threaded Sniffer<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Make sure you run the script with administrative or root privileges, as sniffing requires access to network interfaces. On Linux or macOS, use:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">bash<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">sudo python3 threaded_sniffer.py<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">If you run on Windows, launch the command prompt as Administrator.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">When you browse websites or generate TCP traffic on port 80, you will see packet summaries printed continuously without blocking your console.<\/span><\/p>\n<h2><b>Customizing Packet Handling<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">The packet handler function is the heart of your sniffer. Instead of just printing summaries, you can extract detailed information, such as IP addresses, ports, or payload data.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Example:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">def packet_handler(packet):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0If packet.haslayer(&#8220;IP&#8221;):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ip_src = packet[&#8220;IP&#8221;].src<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ip_dst = packet[&#8220;IP&#8221;].dst<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0print(f&#8221;IP Packet: {ip_src} -&gt; {ip_dst}&#8221;)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0if packet.haslayer(&#8220;TCP&#8221;):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0tcp_sport = packet[&#8220;TCP&#8221;].sport<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0tcp_dport = packet[&#8220;TCP&#8221;].dport<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0print(f&#8221;TCP Ports: {tcp_sport} -&gt; {tcp_dport}&#8221;)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">This prints the source and destination IPs and ports for each packet.<\/span><\/p>\n<h2><b>Using Filters to Improve Efficiency<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Filters are critical in packet sniffing to reduce noise and improve performance. The Berkeley Packet Filter (BPF) syntax is widely used to specify what packets to capture.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Some useful filters:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">&#8220;tcp&#8221; \u2014 capture only TCP packets<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">&#8220;udp&#8221; \u2014 capture only UDP packets<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">&#8220;icmp&#8221; \u2014 capture ICMP (ping) packets<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">&#8220;port 80&#8221; \u2014 capture traffic on port 80 (HTTP)<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">&#8220;host 192.168.1.1&#8221; \u2014 capture traffic to or from a specific IP<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Combining filters is possible, for example: &#8220;tcp and port 443&#8221; captures HTTPS traffic.<\/span><\/p>\n<h2><b>Managing Thread Lifetime and Cleanup<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Because the sniffing thread runs indefinitely by default, managing its lifecycle is important. You can modify the sniff_packets function to stop after a timeout or a certain count.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Example: sniff for 20 packets, then stop.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">def sniff_packets(interface=None, filter=None, count=20):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0sniff(iface=interface, filter=filter, prn=packet_handler, count=count)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">Alternatively, you can add a timeout parameter to stop sniffing after a set number of seconds.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">def sniff_packets(interface=None, filter=None, timeout=30):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0sniff(iface=interface, filter=filter, prn=packet_handler, timeout=timeout)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">Use these techniques to ensure your program doesn\u2019t hang indefinitely.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">In this article, you built a threaded packet sniffer using Scapy and Python\u2019s threading module. Key takeaways:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Using threads allows your sniffing process to run without blocking other code.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Scapy\u2019s sniff() function, combined with callback handlers, enables flexible packet processing.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Applying BPF filters optimizes sniffing performance by reducing captured packets.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Custom packet handlers provide the ability to analyze and react to network traffic programmatically.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Managing thread lifecycle and sniffing parameters like count and timeout helps maintain control over your sniffer.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">This foundation prepares you for more advanced sniffing features such as real-time analysis, logging, and multi-threaded sniffing, which we will cover in the next part of this series.<\/span><\/p>\n<h1><b>Real-Time Analysis and Asynchronous Logging<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">In the previous parts, you learned how to create a basic threaded packet sniffer using Python and Scapy. This article will take it further by integrating real-time packet analysis and asynchronous logging, key features that make a sniffer practical for continuous monitoring and data collection.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">You will learn how to:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Implement live analysis on captured packets inside the thread<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Log packet details asynchronously to avoid slowing down the sniffing process.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Manage thread-safe queues to pass data between threads safely.y<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Use Python\u2019s queue and logging modules effectively.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">By enhancing your sniffer with these capabilities, you create a more powerful and responsive network monitoring tool.<\/span><\/p>\n<h2><b>Why Real-Time Analysis and Asynchronous Logging?<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">When sniffing network traffic, you want to analyze packets as they arrive but avoid delays caused by heavy processing or file writing inside the capture callback. If packet processing takes too long, packets may be dropped.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">By separating packet capture, analysis, and logging into different threads communicating via queues, you ensure smooth operation and scalable design.<\/span><\/p>\n<h2><b>Setting Up the Environment<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Before starting, ensure you have:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Python 3.x installed<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Scapy installed (pip install scapy)<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Basic knowledge of threading and queue modules<\/span><\/li>\n<\/ul>\n<h2><b>Designing the Multi-Threaded Architecture<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">We will implement two primary threads:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\"><b>Sniffer Thread<\/b><span style=\"font-weight: 400;\">: Captures packets and pushes them into a thread-safe queue.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Processor Thread<\/b><span style=\"font-weight: 400;\">: Consumes packets from the queue, performs analysis, and logs results asynchronously.<\/span><\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">This separation prevents the sniffing thread from being blocked by processing delays.<\/span><\/p>\n<h2><b>Step 1: Import Required Modules<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">from scapy.all import sniff<\/span><\/p>\n<p><span style=\"font-weight: 400;\">import threading<\/span><\/p>\n<p><span style=\"font-weight: 400;\">import queue<\/span><\/p>\n<p><span style=\"font-weight: 400;\">import logging<\/span><\/p>\n<p><span style=\"font-weight: 400;\">import time<\/span><\/p>\n<p>&nbsp;<\/p>\n<h2><b>Step 2: Configure Asynchronous Logging<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Set up a logger that writes to a file asynchronously.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">logging.basicConfig(<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0filename=&#8217;packets.log&#8217;,<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0filemode=&#8217;a&#8217;,<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0format=&#8217;%(asctime)s &#8211; %(levelname)s &#8211; %(message)s&#8217;,<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0level=logging.INFO<\/span><\/p>\n<p><span style=\"font-weight: 400;\">)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Logger = logging.getLogger()<\/span><\/p>\n<p>&nbsp;<\/p>\n<h2><b>Step 3: Initialize a Thread-Safe Queue<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">This queue will hold captured packets for processing.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">packet_queue = queue.Queue()<\/span><\/p>\n<p>&nbsp;<\/p>\n<h2><b>Step 4: Modify Packet Handler to Enqueue Packets<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Instead of processing directly, the sniffer thread will place packets in the queue.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">def packet_handler(packet):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0try:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0packet_queue.put(packet)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0Except queue.Full:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0print(&#8220;Warning: Packet queue is full, dropping packet.&#8221;)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">This design allows the sniffing thread to run quickly.<\/span><\/p>\n<h2><b>Step 5: Define the Packet Processing Thread Function<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">This thread will pull packets from the queue, analyze them, and log the information.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">def process_packets():<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0while True:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Try:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0packet = packet_queue.get(timeout=3)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Except queue.Empty:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Continue # No packet to process, loop again<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0analyze_and_log(packet)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0packet_queue.task_done()<\/span><\/p>\n<p>&nbsp;<\/p>\n<h2><b>Step 6: Implement Real-Time Analysis and Logging<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Define a function that extracts key information from each packet and logs it.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">def analyze_and_log(packet):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0If packet.haslayer(&#8220;IP&#8221;):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ip_src = packet[&#8220;IP&#8221;].src<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ip_dst = packet[&#8220;IP&#8221;].dst<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0protocol = packet[&#8220;IP&#8221;].proto<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0log_msg = f&#8221;IP Packet: {ip_src} -&gt; {ip_dst} | Protocol: {protocol}&#8221;<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if packet.haslayer(&#8220;TCP&#8221;):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0tcp_sport = packet[&#8220;TCP&#8221;].sport<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0tcp_dport = packet[&#8220;TCP&#8221;].dport<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0log_msg += f&#8221; | TCP Ports: {tcp_sport} -&gt; {tcp_dport}&#8221;<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0elif packet.haslayer(&#8220;UDP&#8221;):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0udp_sport = packet[&#8220;UDP&#8221;].sport<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0udp_dport = packet[&#8220;UDP&#8221;].dport<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0log_msg += f&#8221; | UDP Ports: {udp_sport} -&gt; {udp_dport}&#8221;<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0logger.info(log_msg)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0print(log_msg)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">This function can be extended to include payload inspection or alert generation.<\/span><\/p>\n<h2><b>Step 7: Start Sniffer and Processor Threads<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Integrate everything in the main function.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">def sniff_packets(interface=None, filter=None, count=0):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0sniff(iface=interface, filter=filter, prn=packet_handler, count=count)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">if __name__ == &#8220;__main__&#8221;:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0interface = &#8220;eth0&#8221;\u00a0 # Update for your system<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0bpf_filter = &#8220;ip&#8221; \u00a0 # Capture all IP traffic<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0# Start the processing thread<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0processor_thread = threading.Thread(target=process_packets)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0processor_thread.daemon = True<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0processor_thread.start()<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0# Start sniffing in the main thread or a separate thread if preferred<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0print(f&#8221;Starting packet capture on {interface} with filter &#8216;{bpf_filter}'&#8221;)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0try:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0sniff_packets(interface=interface, filter=bpf_filter)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0Except KeyboardInterrupt:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0print(&#8220;Exiting&#8230;&#8221;)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0packet_queue.join()\u00a0 # Wait until all packets are processed before exit<\/span><\/p>\n<p>&nbsp;<\/p>\n<h2><b>Advantages of This Architecture<\/b><\/h2>\n<ul>\n<li style=\"font-weight: 400;\"><b>Non-blocking capture<\/b><span style=\"font-weight: 400;\">: Sniffer thread focuses solely on grabbing packets.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Thread-safe communication<\/b><span style=\"font-weight: 400;\">: The Queue safely passes packets between threads.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Scalable logging<\/b><span style=\"font-weight: 400;\">: Logging occurs independently, avoiding bottlenecks.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Real-time console output<\/b><span style=\"font-weight: 400;\">: You see analyzed data live while logs are stored.<\/span><\/li>\n<\/ul>\n<h2><b>Handling Packet Queue Overflow<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">If the packet volume exceeds the processing speed, the queue may fill up. Here are some strategies to handle this:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Increase the queue size with the queue.Queue(maxsize=1000) to buffer more packets.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Implement backpressure or dropping policies to avoid memory overflow.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Optimize analysis logic to speed up processing.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Run multiple processing threads to parallelize work.<\/span><\/li>\n<\/ul>\n<h2><b>Extending Real-Time Analysis<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Beyond basic IP and TCP\/UDP info, you can:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Detect suspicious packets (e.g., SYN floods, port scans)<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Extract and decode payloads (HTTP headers, DNS queries)<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Aggregate statistics (packet counts per IP, protocol breakdowns)<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Trigger alerts or notifications on anomalies<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Such enhancements transform your sniffer into a proactive network security tool.<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">In this article, you advanced your threaded Python sniffer by adding real-time analysis and asynchronous logging. This design separates packet capture and processing responsibilities, improving performance and reliability in live environments.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">You now understand how to:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Use queues for thread-safe packet exchange<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Configure logging to capture detailed packet info<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Analyze packets in a separate thread without blocking sniffing<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Manage the thread lifecycle and graceful shutdown.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">The next part of this series will focus on integrating packet filtering based on custom rules and exporting captured data for offline analysis.<\/span><\/p>\n<h1><b>Advanced Filtering, Custom Handling, and Data Export<\/b><\/h1>\n<p><span style=\"font-weight: 400;\">In the earlier parts of this series, you learned the fundamentals of thread-based sniffing in Python using Scapy, how to structure the code for real-time analysis, and how to implement asynchronous logging. This final part will take your sniffer to the next level by demonstrating how to apply advanced packet filtering, customize packet handling based on rules, and export the captured data for further offline processing.<\/span><\/p>\n<h2><b>Why Advanced Filtering and Data Export Matter<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Networks generate vast amounts of traffic, so capturing everything indiscriminately often leads to overwhelming volumes of data, making meaningful analysis difficult. Filtering packets based on criteria such as IP addresses, protocols, ports, or payload content helps focus on relevant traffic.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Exporting data to external files or databases enables deeper analysis using specialized tools or for long-term storage and audit purposes.<\/span><\/p>\n<h2><b>Step 1: Enhancing Packet Filtering with Custom Rules<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">While Scapy supports Berkeley Packet Filter (BPF) expressions during sniffing, Python allows you to add a layer of filtering in your packet processing thread to implement more complex logic.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Here is how you can combine BPF filters with in-code filtering:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">def custom_filter(packet):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0# Example: Capture only TCP packets destined to port 80 (HTTP)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0If packet.haslayer(&#8220;TCP&#8221;) and packet[&#8220;TCP&#8221;].dport == 80:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return True<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0return False<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">Modify the packet handler to filter before queuing:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">def packet_handler(packet):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0if custom_filter(packet):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0packet_queue.put(packet)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Except queue.Full:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0print(&#8220;Warning: Packet queue is full, dropping packet.&#8221;)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">This two-level filtering lets you balance performance and precision.<\/span><\/p>\n<h2><b>Step 2: Implementing Custom Packet Handling<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Based on the type of packets you are interested in, you can define different actions. For instance, if you want to detect HTTP GET requests, you can analyze the TCP payload.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">def analyze_and_log(packet):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0If packet.haslayer(&#8220;IP&#8221;):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ip_src = packet[&#8220;IP&#8221;].src<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ip_dst = packet[&#8220;IP&#8221;].dst<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0protocol = packet[&#8220;IP&#8221;].proto<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0log_msg = f&#8221;IP Packet: {ip_src} -&gt; {ip_dst} | Protocol: {protocol}&#8221;<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if packet.haslayer(&#8220;TCP&#8221;):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0tcp_sport = packet[&#8220;TCP&#8221;].sport<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0tcp_dport = packet[&#8220;TCP&#8221;].dport<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0log_msg += f&#8221; | TCP Ports: {tcp_sport} -&gt; {tcp_dport}&#8221;<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# Inspect the payload for an HTTP GET request<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0in the packet.haslayer(&#8220;Raw&#8221;):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0payload = packet[&#8220;Raw&#8221;].load.decode(errors=&#8217;ignore&#8217;)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0If payload.startswith(&#8220;GET&#8221;):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0log_msg += &#8221; | HTTP GET request detected&#8221;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# You could extract the requested URL or headers here<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0logger.info(log_msg)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0print(log_msg)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">This allows you to detect and log application-layer events, providing richer context.<\/span><\/p>\n<h2><b>Step 3: Exporting Captured Packets for Offline Analysis<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Exporting packets is essential for sharing data with analysis tools like Wireshark or for archival. Scapy supports saving packets to PCAP files, which are the standard for packet data.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">To save captured packets:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Initialize a packet list to store packets.<\/span><\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">captured_packets = []<\/span><\/p>\n<p>&nbsp;<\/p>\n<ol>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Modify the packet handler or processing thread to append packets to this list.<\/span><\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">def packet_handler(packet):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0if custom_filter(packet):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0packet_queue.put(packet)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0captured_packets.append(packet)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Except queue.Full:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0print(&#8220;Warning: Packet queue is full, dropping packet.&#8221;)<\/span><\/p>\n<p>&nbsp;<\/p>\n<ol>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">After stopping the sniffer, save the list to a pcap file.<\/span><\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">from scapy.utils import wrpcap<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">def save_packets(filename=&#8221;captured_packets.pcap&#8221;):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0wrpcap(filename, captured_packets)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0print(f&#8221;Saved {len(captured_packets)} packets to {filename}&#8221;)<\/span><\/p>\n<p>&nbsp;<\/p>\n<ol>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Call save_packets() during graceful shutdown.<\/span><\/li>\n<\/ol>\n<h2><b>Step 4: Integrating Graceful Shutdown and Cleanup<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Ensure that when the user interrupts the sniffing process, all packets are processed, and data is saved.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">import signal<\/span><\/p>\n<p><span style=\"font-weight: 400;\">import sys<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">def signal_handler(sig, frame):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0print(&#8220;Interrupt received, shutting down&#8230;&#8221;)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0packet_queue.join()<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0save_packets()<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0sys.exit(0)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">signal.signal(signal.SIGINT, signal_handler)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">This approach handles Ctrl+C interruptions cleanly.<\/span><\/p>\n<h2><b>Step 5: Full Example Incorporating All Features<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">python<\/span><\/p>\n<p><span style=\"font-weight: 400;\">CopyEdit<\/span><\/p>\n<p><span style=\"font-weight: 400;\">from scapy.all import sniff<\/span><\/p>\n<p><span style=\"font-weight: 400;\">from scapy.utils import wrpcap<\/span><\/p>\n<p><span style=\"font-weight: 400;\">import threading<\/span><\/p>\n<p><span style=\"font-weight: 400;\">import queue<\/span><\/p>\n<p><span style=\"font-weight: 400;\">import logging<\/span><\/p>\n<p><span style=\"font-weight: 400;\">import signal<\/span><\/p>\n<p><span style=\"font-weight: 400;\">import sys<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">logging.basicConfig(<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0filename=&#8217;packets.log&#8217;,<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0filemode=&#8217;a&#8217;,<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0format=&#8217;%(asctime)s &#8211; %(levelname)s &#8211; %(message)s&#8217;,<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0level=logging.INFO<\/span><\/p>\n<p><span style=\"font-weight: 400;\">)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">logger = logging.getLogger()<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">packet_queue = queue.Queue(maxsize=1000)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">captured_packets = []<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">def custom_filter(packet):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0If packet.haslayer(&#8220;TCP&#8221;) and packet[&#8220;TCP&#8221;].dport == 80:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return True<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0return False<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">def packet_handler(packet):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0if custom_filter(packet):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0try:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0packet_queue.put(packet)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0captured_packets.append(packet)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Except queue.Full:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0print(&#8220;Warning: Packet queue full, dropping packet.&#8221;)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">def analyze_and_log(packet):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0if packet.haslayer(&#8220;IP&#8221;):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ip_src = packet[&#8220;IP&#8221;].src<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ip_dst = packet[&#8220;IP&#8221;].dst<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0protocol = packet[&#8220;IP&#8221;].proto<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0log_msg = f&#8221;IP Packet: {ip_src} -&gt; {ip_dst} | Protocol: {protocol}&#8221;<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if packet.haslayer(&#8220;TCP&#8221;):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0tcp_sport = packet[&#8220;TCP&#8221;].sport<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0tcp_dport = packet[&#8220;TCP&#8221;].dport<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0log_msg += f&#8221; | TCP Ports: {tcp_sport} -&gt; {tcp_dport}&#8221;<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0if packet.haslayer(&#8220;Raw&#8221;):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0payload = packet[&#8220;Raw&#8221;].load.decode(errors=&#8217;ignore&#8217;)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0If payload.startswith(&#8220;GET&#8221;):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0log_msg += &#8221; | HTTP GET request detected&#8221;<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0logger.info(log_msg)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0print(log_msg)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">def process_packets():<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0while True:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Try:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0packet = packet_queue.get(timeout=3)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Except queue.Empty:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0continue<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0analyze_and_log(packet)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0packet_queue.task_done()<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">def save_packets(filename=&#8221;captured_packets.pcap&#8221;):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0wrpcap(filename, captured_packets)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0print(f&#8221;Saved {len(captured_packets)} packets to {filename}&#8221;)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">def signal_handler(sig, frame):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0print(&#8220;Interrupt received, shutting down&#8230;&#8221;)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0packet_queue.join()<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0save_packets()<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0sys.exit(0)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">def sniff_packets(interface=None, filter=None, count=0):<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0sniff(iface=interface, filter=filter, prn=packet_handler, count=count)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">if __name__ == &#8220;__main__&#8221;:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0signal.signal(signal.SIGINT, signal_handler)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0interface = &#8220;eth0&#8221;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0bpf_filter = &#8220;tcp port 80&#8221;<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0processor_thread = threading.Thread(target=process_packets)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0processor_thread.daemon = True<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0processor_thread.start()<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0print(f&#8221;Starting packet capture on {interface} with filter &#8216;{bpf_filter}'&#8221;)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0sniff_packets(interface=interface, filter=bpf_filter)<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">This final part completes a robust thread-based network sniffer in Python using Scapy, equipped with:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Layered packet filtering combining BPF and custom logic<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Advanced packet content inspection for application-layer data<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Asynchronous logging for efficient record keeping<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Safe multithreaded design with queues<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Packet export for offline review and sharing<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Graceful shutdown to avoid data loss<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">By building upon these foundations, you can customize the sniffer to your specific use cases such as intrusion detection, traffic analysis, or network troubleshooting.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">If you want to extend further, consider adding GUI controls, integrating alerting systems, or performing machine learning-based anomaly detection on the captured traffic.<\/span><\/p>\n<h2><b>Final Thoughts<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Building a thread-based network sniffer in Python with Scapy opens up powerful possibilities for capturing and analyzing network traffic in real time. Throughout this series, you\u2019ve seen how threading helps handle packet processing efficiently without losing data, especially when dealing with high-speed networks or complex traffic patterns.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">By combining built-in Berkeley Packet Filter expressions with custom in-code filtering, you can precisely target the packets that matter most to your analysis. This layered filtering approach optimizes performance and focuses on relevant traffic without overwhelming your system.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The ability to inspect packets beyond basic headers, such as detecting HTTP requests or analyzing payload contents, elevates your sniffer from a passive listener to an active network observer. Incorporating asynchronous logging preserves system responsiveness while maintaining comprehensive records for auditing or troubleshooting.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Exporting captured packets to standard PCAP files ensures your data can be reviewed or shared with other tools like Wireshark, facilitating deeper offline analysis and collaboration. Additionally, building graceful shutdown handling protects against data loss and guarantees clean resource management.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">While this series covered a solid foundation, the realm of network sniffing offers many more advanced avenues. You could integrate real-time alerting, visualization dashboards, protocol-specific dissectors, or even machine learning models to detect anomalies and intrusions automatically.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Mastering thread-based sniffing with Scapy is a valuable skillset for network administrators, security professionals, and developers alike. It equips you with hands-on control over your network monitoring efforts, enabling tailored solutions to complex networking challenges.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">I encourage you to experiment further, customize the examples, and build tools that fit your unique needs. With Python\u2019s flexibility and Scapy\u2019s powerful packet manipulation capabilities, the possibilities for network analysis and security are vast.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">If you ever want to explore specific features or expand your sniffer into a comprehensive monitoring system, feel free to reach out. Happy sniffing!<\/span><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Network sniffing is a foundational technique in the fields of network security, performance monitoring, and troubleshooting. By capturing and analyzing network packets, professionals gain visibility into traffic patterns, detect anomalies, and investigate potential threats. Python, with its rich ecosystem of libraries, offers powerful tools to build custom sniffing solutions. Among these tools, Scapy stands out\u2026 <span class=\"read-more\"><a href=\"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/\">Read More &raquo;<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2374,2378],"tags":[143,1438,1563],"class_list":["post-5607","post","type-post","status-publish","format-standard","hentry","category-all-technology","category-programming","tag-network","tag-scapy","tag-sniffing"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"Network sniffing is a foundational technique in the fields of network security, performance monitoring, and troubleshooting. By capturing and analyzing network packets, professionals gain visibility into traffic patterns, detect anomalies, and investigate potential threats. Python, with its rich ecosystem of libraries, offers powerful tools to build custom sniffing solutions. Among these tools, Scapy stands out\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"blog_admin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ExamCollection - ExamCollection - #1 Free Source of IT Certification Exams Questions\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Python Thread-Based Network Sniffing with Scapy - ExamCollection\" \/>\n\t\t<meta property=\"og:description\" content=\"Network sniffing is a foundational technique in the fields of network security, performance monitoring, and troubleshooting. By capturing and analyzing network packets, professionals gain visibility into traffic patterns, detect anomalies, and investigate potential threats. Python, with its rich ecosystem of libraries, offers powerful tools to build custom sniffing solutions. Among these tools, Scapy stands out\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-05-28T09:10:38+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-01-08T05:56:28+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Python Thread-Based Network Sniffing with Scapy - ExamCollection\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Network sniffing is a foundational technique in the fields of network security, performance monitoring, and troubleshooting. By capturing and analyzing network packets, professionals gain visibility into traffic patterns, detect anomalies, and investigate potential threats. Python, with its rich ecosystem of libraries, offers powerful tools to build custom sniffing solutions. Among these tools, Scapy stands out\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/python-thread-based-network-sniffing-with-scapy\\\/#blogposting\",\"name\":\"Python Thread-Based Network Sniffing with Scapy - ExamCollection\",\"headline\":\"Python Thread-Based Network Sniffing with Scapy\",\"author\":{\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/author\\\/blog_admin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/#organization\"},\"datePublished\":\"2025-05-28T09:10:38+00:00\",\"dateModified\":\"2026-01-08T05:56:28+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/python-thread-based-network-sniffing-with-scapy\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/python-thread-based-network-sniffing-with-scapy\\\/#webpage\"},\"articleSection\":\"All Technology, Programming, network, Scapy, Sniffing\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/python-thread-based-network-sniffing-with-scapy\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/category\\\/technology\\\/#listItem\",\"name\":\"Technology\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/category\\\/technology\\\/#listItem\",\"position\":2,\"name\":\"Technology\",\"item\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/category\\\/technology\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/category\\\/technology\\\/all-technology\\\/#listItem\",\"name\":\"All Technology\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/category\\\/technology\\\/all-technology\\\/#listItem\",\"position\":3,\"name\":\"All Technology\",\"item\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/category\\\/technology\\\/all-technology\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/python-thread-based-network-sniffing-with-scapy\\\/#listItem\",\"name\":\"Python Thread-Based Network Sniffing with Scapy\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/category\\\/technology\\\/#listItem\",\"name\":\"Technology\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/python-thread-based-network-sniffing-with-scapy\\\/#listItem\",\"position\":4,\"name\":\"Python Thread-Based Network Sniffing with Scapy\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/category\\\/technology\\\/all-technology\\\/#listItem\",\"name\":\"All Technology\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/#organization\",\"name\":\"ExamCollection\",\"description\":\"ExamCollection - #1 Free Source of IT Certification Exams Questions\",\"url\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/author\\\/blog_admin\\\/#author\",\"url\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/author\\\/blog_admin\\\/\",\"name\":\"blog_admin\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/python-thread-based-network-sniffing-with-scapy\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/78d7b86a720ab2165ea0f9be8f18356ac5cea00981c075a5e82678249e79df77?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"blog_admin\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/python-thread-based-network-sniffing-with-scapy\\\/#webpage\",\"url\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/python-thread-based-network-sniffing-with-scapy\\\/\",\"name\":\"Python Thread-Based Network Sniffing with Scapy - ExamCollection\",\"description\":\"Network sniffing is a foundational technique in the fields of network security, performance monitoring, and troubleshooting. By capturing and analyzing network packets, professionals gain visibility into traffic patterns, detect anomalies, and investigate potential threats. Python, with its rich ecosystem of libraries, offers powerful tools to build custom sniffing solutions. Among these tools, Scapy stands out\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/python-thread-based-network-sniffing-with-scapy\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/author\\\/blog_admin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/author\\\/blog_admin\\\/#author\"},\"datePublished\":\"2025-05-28T09:10:38+00:00\",\"dateModified\":\"2026-01-08T05:56:28+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/\",\"name\":\"ExamCollection\",\"description\":\"ExamCollection - #1 Free Source of IT Certification Exams Questions\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.examcollection.com\\\/blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Python Thread-Based Network Sniffing with Scapy - ExamCollection","description":"Network sniffing is a foundational technique in the fields of network security, performance monitoring, and troubleshooting. By capturing and analyzing network packets, professionals gain visibility into traffic patterns, detect anomalies, and investigate potential threats. Python, with its rich ecosystem of libraries, offers powerful tools to build custom sniffing solutions. Among these tools, Scapy stands out","canonical_url":"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/#blogposting","name":"Python Thread-Based Network Sniffing with Scapy - ExamCollection","headline":"Python Thread-Based Network Sniffing with Scapy","author":{"@id":"https:\/\/www.examcollection.com\/blog\/author\/blog_admin\/#author"},"publisher":{"@id":"https:\/\/www.examcollection.com\/blog\/#organization"},"datePublished":"2025-05-28T09:10:38+00:00","dateModified":"2026-01-08T05:56:28+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/#webpage"},"isPartOf":{"@id":"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/#webpage"},"articleSection":"All Technology, Programming, network, Scapy, Sniffing"},{"@type":"BreadcrumbList","@id":"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.examcollection.com\/blog\/#listItem","position":1,"name":"Home","item":"https:\/\/www.examcollection.com\/blog\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.examcollection.com\/blog\/category\/technology\/#listItem","name":"Technology"}},{"@type":"ListItem","@id":"https:\/\/www.examcollection.com\/blog\/category\/technology\/#listItem","position":2,"name":"Technology","item":"https:\/\/www.examcollection.com\/blog\/category\/technology\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.examcollection.com\/blog\/category\/technology\/all-technology\/#listItem","name":"All Technology"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.examcollection.com\/blog\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.examcollection.com\/blog\/category\/technology\/all-technology\/#listItem","position":3,"name":"All Technology","item":"https:\/\/www.examcollection.com\/blog\/category\/technology\/all-technology\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/#listItem","name":"Python Thread-Based Network Sniffing with Scapy"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.examcollection.com\/blog\/category\/technology\/#listItem","name":"Technology"}},{"@type":"ListItem","@id":"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/#listItem","position":4,"name":"Python Thread-Based Network Sniffing with Scapy","previousItem":{"@type":"ListItem","@id":"https:\/\/www.examcollection.com\/blog\/category\/technology\/all-technology\/#listItem","name":"All Technology"}}]},{"@type":"Organization","@id":"https:\/\/www.examcollection.com\/blog\/#organization","name":"ExamCollection","description":"ExamCollection - #1 Free Source of IT Certification Exams Questions","url":"https:\/\/www.examcollection.com\/blog\/"},{"@type":"Person","@id":"https:\/\/www.examcollection.com\/blog\/author\/blog_admin\/#author","url":"https:\/\/www.examcollection.com\/blog\/author\/blog_admin\/","name":"blog_admin","image":{"@type":"ImageObject","@id":"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/78d7b86a720ab2165ea0f9be8f18356ac5cea00981c075a5e82678249e79df77?s=96&d=mm&r=g","width":96,"height":96,"caption":"blog_admin"}},{"@type":"WebPage","@id":"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/#webpage","url":"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/","name":"Python Thread-Based Network Sniffing with Scapy - ExamCollection","description":"Network sniffing is a foundational technique in the fields of network security, performance monitoring, and troubleshooting. By capturing and analyzing network packets, professionals gain visibility into traffic patterns, detect anomalies, and investigate potential threats. Python, with its rich ecosystem of libraries, offers powerful tools to build custom sniffing solutions. Among these tools, Scapy stands out","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.examcollection.com\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/#breadcrumblist"},"author":{"@id":"https:\/\/www.examcollection.com\/blog\/author\/blog_admin\/#author"},"creator":{"@id":"https:\/\/www.examcollection.com\/blog\/author\/blog_admin\/#author"},"datePublished":"2025-05-28T09:10:38+00:00","dateModified":"2026-01-08T05:56:28+00:00"},{"@type":"WebSite","@id":"https:\/\/www.examcollection.com\/blog\/#website","url":"https:\/\/www.examcollection.com\/blog\/","name":"ExamCollection","description":"ExamCollection - #1 Free Source of IT Certification Exams Questions","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.examcollection.com\/blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"ExamCollection - ExamCollection - #1 Free Source of IT Certification Exams Questions","og:type":"article","og:title":"Python Thread-Based Network Sniffing with Scapy - ExamCollection","og:description":"Network sniffing is a foundational technique in the fields of network security, performance monitoring, and troubleshooting. By capturing and analyzing network packets, professionals gain visibility into traffic patterns, detect anomalies, and investigate potential threats. Python, with its rich ecosystem of libraries, offers powerful tools to build custom sniffing solutions. Among these tools, Scapy stands out","og:url":"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/","article:published_time":"2025-05-28T09:10:38+00:00","article:modified_time":"2026-01-08T05:56:28+00:00","twitter:card":"summary_large_image","twitter:title":"Python Thread-Based Network Sniffing with Scapy - ExamCollection","twitter:description":"Network sniffing is a foundational technique in the fields of network security, performance monitoring, and troubleshooting. By capturing and analyzing network packets, professionals gain visibility into traffic patterns, detect anomalies, and investigate potential threats. Python, with its rich ecosystem of libraries, offers powerful tools to build custom sniffing solutions. Among these tools, Scapy stands out"},"aioseo_meta_data":{"post_id":"5607","title":null,"description":null,"keywords":null,"keyphrases":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"limit_modified_date":false,"created":"2026-10-08 15:19:43","updated":"2026-10-08 15:19:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null,"primary_term":null,"ai":null,"breadcrumb_settings":null,"seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.examcollection.com\/blog\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.examcollection.com\/blog\/category\/technology\/\" title=\"Technology\">Technology<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.examcollection.com\/blog\/category\/technology\/all-technology\/\" title=\"All Technology\">All Technology<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tPython Thread-Based Network Sniffing with Scapy\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.examcollection.com\/blog\/"},{"label":"Technology","link":"https:\/\/www.examcollection.com\/blog\/category\/technology\/"},{"label":"All Technology","link":"https:\/\/www.examcollection.com\/blog\/category\/technology\/all-technology\/"},{"label":"Python Thread-Based Network Sniffing with Scapy","link":"https:\/\/www.examcollection.com\/blog\/python-thread-based-network-sniffing-with-scapy\/"}],"_links":{"self":[{"href":"https:\/\/www.examcollection.com\/blog\/wp-json\/wp\/v2\/posts\/5607","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.examcollection.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examcollection.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examcollection.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examcollection.com\/blog\/wp-json\/wp\/v2\/comments?post=5607"}],"version-history":[{"count":2,"href":"https:\/\/www.examcollection.com\/blog\/wp-json\/wp\/v2\/posts\/5607\/revisions"}],"predecessor-version":[{"id":9169,"href":"https:\/\/www.examcollection.com\/blog\/wp-json\/wp\/v2\/posts\/5607\/revisions\/9169"}],"wp:attachment":[{"href":"https:\/\/www.examcollection.com\/blog\/wp-json\/wp\/v2\/media?parent=5607"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examcollection.com\/blog\/wp-json\/wp\/v2\/categories?post=5607"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examcollection.com\/blog\/wp-json\/wp\/v2\/tags?post=5607"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}