title: BPF in python to sniff packets for multiple TCP ports
body: <p>I got code from <a href="http://allanrbo.blogspot.in/2011/12/raw-sockets-with-bpf-in-python.html" rel="nofollow noreferrer">http://allanrbo.blogspot.in/2011/12/raw-sockets-with-bpf-in-python.html</a>. It works fine, but I want to sniff the traffic on multiple TCP ports like port <code>9000</code>, <code>80</code>, <code>22</code>...</p>
  
  <p>So I have modified the <code>filter_list</code> like blow</p>
  
  <pre><code>filters_list = [  
      # Must have dst port 67. Load (BPF_LD) a half word value (BPF_H) in   
      # ethernet frame at absolute byte offset 36 (BPF_ABS). If value is equal to  
      # 67 then do not jump, else jump 5 statements.  
      bpf_stmt(BPF_LD | BPF_H | BPF_ABS, 36),  
      bpf_jump(BPF_JMP | BPF_JEQ | BPF_K, 9000, 0, 5), &lt;===== Here I added another port
      bpf_jump(BPF_JMP | BPF_JEQ | BPF_K, 80, 0, 5),
  
  
      # Must be UDP (check protocol field at byte offset 23)  
      bpf_stmt(BPF_LD | BPF_B | BPF_ABS, 23),   
      bpf_jump(BPF_JMP | BPF_JEQ | BPF_K, 0x06, 0, 3), #&lt;==Changed for TCP "0x06"
  
      # Must be IPv4 (check ethertype field at byte offset 12)  
      bpf_stmt(BPF_LD | BPF_H | BPF_ABS, 12),   
      bpf_jump(BPF_JMP | BPF_JEQ | BPF_K, 0x0800, 0, 1),  
  
      bpf_stmt(BPF_RET | BPF_K, 0x0fffffff), # pass  
      bpf_stmt(BPF_RET | BPF_K, 0), # reject   ]
  </code></pre>
  
  <p>The thing is, sometimes it is working sometimes it is not, like getting traffic only on 9000 but not 80, sometimes getting traffic on 80. I didnt understood the code completely. Any help?</p>