title: Simple Raw Packet Sniffer In Python
body: <p>First, I'm a beginner in python. I developed a simple raw packet sniffer utilizing the <code>PF_PACKET</code> interface that operates at layer 2.</p>
  
  <p>The sniffer simply figures out the following...
  - Ethernet Header (Source - Destination - Protocol)
  - IP Header (Source IP - Destination IP)
  - TCP Header(Source Port - Destination Port)</p>
  
  <p>Here's the code I've written so far...</p>
  
  <pre><code>#!/usr/bin/env python
  import struct
  import socket
  import binascii
  
  rawSocket=socket.socket(socket.PF_PACKET,socket.SOCK_RAW,socket.htons(0x0800))
  #ifconfig eth0 promisc up
  receivedPacket=rawSocket.recv(2048)
  
  #Ethernet Header...
  ethernetHeader=receivedPacket[0][0:14]
  ethrheader=struct.unpack("!6s6s2s",ethernetHeader)
  destinationIP= binascii.hexlify(ethrheader[0])
  sourceIP= binascii.hexlify(ethrheader[1])
  protocol= binascii.hexlify(ethrheader[2])
  print "Destinatiom: " + destinationIP
  print "Souce: " + sourceIP
  print "Protocol: "+ protocol
  
  #IP Header... 
  ipHeader=receivedPacket[0][14:34]
  ipHdr=struct.unpack("!12s4s4s",ipHeader)
  destinationIP=socket.inet_ntoa(ipHdr[2])
  print "Source IP: " +sourceIP
  print "Destination IP: "+destinationIP
  
  #TCP Header...
  tcpHeader=receivedPacket[0][34:54]
  tcpHdr=struct.unpack("!2s2s16s",tcpHeader)
  sourcePort=socket.inet_ntoa(tcpHdr[0])
  destinationPort=socket.inet_ntoa(tcpHdr[1])
  print "Source Port: " + sourcePort
  print "Destination Port: " + destinationPort
  </code></pre>
  
  <p>I seem to encounter a problem in the ethernet header part and the unpack method that I can't figure out. Thanks in advance :) </p>