We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
tcpdump check error in centos
#### Brief description

> I have installed tcpdump in PATH, but it reports:
scapy.error.Scapy_Exception: tcpdump is not available. Cannot use filter !
I found the code which check tcudmp in /opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/scapy/arch/common.py:

```
def _check_tcpdump():
    """
    Return True if the tcpdump command can be started
    """
    with open(os.devnull, 'wb') as devnull:
        try:
            proc = subprocess.Popen([conf.prog.tcpdump, "--version"],
                                    stdout=devnull, stderr=subprocess.STDOUT)
        except OSError:
            return False
    return proc.wait() == 0
```


the error is that tcpdump --version return 1 instead of 0
eg:
```
[root@localhost proxy]# tcpdump --version
tcpdump version 4.1-PRE-CVS_2017_03_21
libpcap version 1.4.0
Usage: tcpdump [-aAdDefhIJKlLnNOpqRStuUvxX] [ -B size ] [ -c count ]
		[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]
		[ -i interface ] [ -j tstamptype ] [ -M secret ]
		[ -Q|-P in|out|inout ]
		[ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
		[ -W filecount ] [ -y datalinktype ] [ -z command ]
		[ -Z user ] [ expression ]
[root@localhost proxy]# echo $?
1
```

#### Environment

```
[root@localhost proxy]# python3.6 --version
Python 3.6.3
[root@localhost proxy]# pip3.6 freeze
certifi==2018.11.29
chardet==3.0.4
idna==2.8
protobuf==3.6.1
psutil==5.4.8
PyMySQL==0.9.3
redis==3.0.1
requests==2.21.0
s8-protocol==1.0
scapy==2.4.2
six==1.11.0
snakeMQ==1.6
urllib3==1.24.1
virtualenv==15.1.0
xlrd==1.2.0
You are using pip version 9.0.1, however version 19.0.2 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
[root@localhost proxy]# uname -a
Linux localhost.localdomain 2.6.32-431.el6.x86_64 #1 SMP Fri Nov 22 03:15:09 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost proxy]# cat /etc/issue
CentOS release 6.5 (Final)
Kernel \r on an \m
```


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `scapy/arch/common.py`
Content:
```
1 # This file is part of Scapy
2 # See http://www.secdev.org/projects/scapy for more information
3 # Copyright (C) Philippe Biondi <phil@secdev.org>
4 # This program is published under a GPLv2 license
5 
6 """
7 Functions common to different architectures
8 """
9 
10 import ctypes
11 import os
12 import socket
13 import struct
14 import subprocess
15 import time
16 from ctypes import POINTER, Structure
17 from ctypes import c_uint, c_uint32, c_ushort, c_ubyte
18 from scapy.consts import WINDOWS
19 from scapy.config import conf
20 from scapy.data import MTU
21 from scapy.error import Scapy_Exception
22 import scapy.modules.six as six
23 
24 if not WINDOWS:
25     from fcntl import ioctl
26 
27 # BOOT
28 
29 
30 def _check_tcpdump():
31     """
32     Return True if the tcpdump command can be started
33     """
34     try:
35         proc = subprocess.Popen(
36             [conf.prog.tcpdump, "--version"],
37             stdout=subprocess.PIPE,
38             stderr=subprocess.STDOUT
39         )
40         output = proc.communicate()[0]
41     except OSError:
42         return False
43 
44     # On some systems, --version does not exist on tcpdump
45     return proc.returncode == 0 or output.startswith(b'Usage: tcpdump ')
46 
47 
48 # This won't be used on Windows
49 TCPDUMP = WINDOWS or _check_tcpdump()
50 
51 # UTILS
52 
53 
54 def get_if(iff, cmd):
55     """Ease SIOCGIF* ioctl calls"""
56 
57     sck = socket.socket()
58     ifreq = ioctl(sck, cmd, struct.pack("16s16x", iff.encode("utf8")))
59     sck.close()
60     return ifreq
61 
62 
63 def get_if_raw_hwaddr(iff):
64     """Get the raw MAC address of a local interface.
65 
66     This function uses SIOCGIFHWADDR calls, therefore only works
67     on some distros.
68 
69     :param iff: the network interface name as a string
70     :returns: the corresponding raw MAC address
71     """
72     from scapy.arch import SIOCGIFHWADDR
73     return struct.unpack("16xh6s8x", get_if(iff, SIOCGIFHWADDR))
74 
75 # SOCKET UTILS
76 
77 
78 def _select_nonblock(sockets, remain=None):
79     """This function is called during sendrecv() routine to select
80     the available sockets.
81     """
82     # pcap sockets aren't selectable, so we return all of them
83     # and ask the selecting functions to use nonblock_recv instead of recv
84     def _sleep_nonblock_recv(self):
85         res = self.nonblock_recv()
86         if res is None:
87             time.sleep(conf.recv_poll_rate)
88         return res
89     # we enforce remain=None: don't wait.
90     return sockets, _sleep_nonblock_recv
91 
92 # BPF HANDLERS
93 
94 
95 class bpf_insn(Structure):
96     """"The BPF instruction data structure"""
97     _fields_ = [("code", c_ushort),
98                 ("jt", c_ubyte),
99                 ("jf", c_ubyte),
100                 ("k", c_uint32)]
101 
102 
103 class bpf_program(Structure):
104     """"Structure for BIOCSETF"""
105     _fields_ = [("bf_len", c_uint),
106                 ("bf_insns", POINTER(bpf_insn))]
107 
108 
109 def _legacy_bpf_pointer(tcpdump_lines):
110     """Get old-format BPF Pointer. Deprecated"""
111     X86_64 = os.uname()[4] in ['x86_64', 'aarch64']
112     size = int(tcpdump_lines[0])
113     bpf = b""
114     for l in tcpdump_lines[1:]:
115         if six.PY2:
116             int_type = long  # noqa: F821
117         else:
118             int_type = int
119         bpf += struct.pack("HBBI", *map(int_type, l.split()))
120 
121     # Thanks to http://www.netprojects.de/scapy-with-pypy-solved/ for the pypy trick  # noqa: E501
122     if conf.use_pypy:
123         str_buffer = ctypes.create_string_buffer(bpf)
124         return struct.pack('HL', size, ctypes.addressof(str_buffer))
125     else:
126         # XXX. Argl! We need to give the kernel a pointer on the BPF,
127         # Python object header seems to be 20 bytes. 36 bytes for x86 64bits arch.  # noqa: E501
128         if X86_64:
129             return struct.pack("HL", size, id(bpf) + 36)
130         else:
131             return struct.pack("HI", size, id(bpf) + 20)
132 
133 
134 def get_bpf_pointer(tcpdump_lines):
135     """Create a BPF Pointer for TCPDump filter"""
136     if conf.use_pypy:
137         return _legacy_bpf_pointer(tcpdump_lines)
138 
139     # Allocate BPF instructions
140     size = int(tcpdump_lines[0])
141     bpf_insn_a = bpf_insn * size
142     bip = bpf_insn_a()
143 
144     # Fill the BPF instruction structures with the byte code
145     tcpdump_lines = tcpdump_lines[1:]
146     i = 0
147     for line in tcpdump_lines:
148         values = [int(v) for v in line.split()]
149         bip[i].code = c_ushort(values[0])
150         bip[i].jt = c_ubyte(values[1])
151         bip[i].jf = c_ubyte(values[2])
152         bip[i].k = c_uint(values[3])
153         i += 1
154 
155     # Create the BPF program
156     return bpf_program(size, bip)
157 
158 
159 def compile_filter(bpf_filter, iface=None):
160     """Asks Tcpdump to parse the filter, then build the matching
161     BPF bytecode using get_bpf_pointer.
162     """
163     if not TCPDUMP:
164         raise Scapy_Exception("tcpdump is not available. Cannot use filter !")
165     try:
166         process = subprocess.Popen([
167             conf.prog.tcpdump,
168             "-p",
169             "-i", (conf.iface if iface is None else iface),
170             "-ddd",
171             "-s", str(MTU),
172             bpf_filter],
173             stdout=subprocess.PIPE,
174             stderr=subprocess.PIPE
175         )
176     except OSError as ex:
177         raise Scapy_Exception("Failed to attach filter: %s" % ex)
178     lines, err = process.communicate()
179     ret = process.returncode
180     if ret:
181         raise Scapy_Exception(
182             "Failed to attach filter: tcpdump returned: %s" % err
183         )
184     lines = lines.strip().split(b"\n")
185     return get_bpf_pointer(lines)
186
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/scapy/arch/common.py b/scapy/arch/common.py
--- a/scapy/arch/common.py
+++ b/scapy/arch/common.py
@@ -42,7 +42,9 @@
         return False
 
     # On some systems, --version does not exist on tcpdump
-    return proc.returncode == 0 or output.startswith(b'Usage: tcpdump ')
+    return proc.returncode == 0 \
+        or output.startswith(b'Usage: tcpdump ') \
+        or output.startswith(b'tcpdump: unrecognized option')
 
 
 # This won't be used on Windows

{"golden_diff": "diff --git a/scapy/arch/common.py b/scapy/arch/common.py\n--- a/scapy/arch/common.py\n+++ b/scapy/arch/common.py\n@@ -42,7 +42,9 @@\n         return False\n \n     # On some systems, --version does not exist on tcpdump\n-    return proc.returncode == 0 or output.startswith(b'Usage: tcpdump ')\n+    return proc.returncode == 0 \\\n+        or output.startswith(b'Usage: tcpdump ') \\\n+        or output.startswith(b'tcpdump: unrecognized option')\n \n \n # This won't be used on Windows\n", "issue": "tcpdump check error in centos\n#### Brief description\r\n\r\n> I have installed tcpdump in PATH, but it reports:\r\nscapy.error.Scapy_Exception: tcpdump is not available. Cannot use filter !\r\nI found the code which check tcudmp in /opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/scapy/arch/common.py:\r\n\r\n```\r\ndef _check_tcpdump():\r\n    \"\"\"\r\n    Return True if the tcpdump command can be started\r\n    \"\"\"\r\n    with open(os.devnull, 'wb') as devnull:\r\n        try:\r\n            proc = subprocess.Popen([conf.prog.tcpdump, \"--version\"],\r\n                                    stdout=devnull, stderr=subprocess.STDOUT)\r\n        except OSError:\r\n            return False\r\n    return proc.wait() == 0\r\n```\r\n\r\n\r\nthe error is that tcpdump --version return 1 instead of 0\r\neg:\r\n```\r\n[root@localhost proxy]# tcpdump --version\r\ntcpdump version 4.1-PRE-CVS_2017_03_21\r\nlibpcap version 1.4.0\r\nUsage: tcpdump [-aAdDefhIJKlLnNOpqRStuUvxX] [ -B size ] [ -c count ]\r\n\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\r\n\t\t[ -i interface ] [ -j tstamptype ] [ -M secret ]\r\n\t\t[ -Q|-P in|out|inout ]\r\n\t\t[ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]\r\n\t\t[ -W filecount ] [ -y datalinktype ] [ -z command ]\r\n\t\t[ -Z user ] [ expression ]\r\n[root@localhost proxy]# echo $?\r\n1\r\n```\r\n\r\n#### Environment\r\n\r\n```\r\n[root@localhost proxy]# python3.6 --version\r\nPython 3.6.3\r\n[root@localhost proxy]# pip3.6 freeze\r\ncertifi==2018.11.29\r\nchardet==3.0.4\r\nidna==2.8\r\nprotobuf==3.6.1\r\npsutil==5.4.8\r\nPyMySQL==0.9.3\r\nredis==3.0.1\r\nrequests==2.21.0\r\ns8-protocol==1.0\r\nscapy==2.4.2\r\nsix==1.11.0\r\nsnakeMQ==1.6\r\nurllib3==1.24.1\r\nvirtualenv==15.1.0\r\nxlrd==1.2.0\r\nYou are using pip version 9.0.1, however version 19.0.2 is available.\r\nYou should consider upgrading via the 'pip install --upgrade pip' command.\r\n[root@localhost proxy]# uname -a\r\nLinux localhost.localdomain 2.6.32-431.el6.x86_64 #1 SMP Fri Nov 22 03:15:09 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux\r\n[root@localhost proxy]# cat /etc/issue\r\nCentOS release 6.5 (Final)\r\nKernel \\r on an \\m\r\n```\r\n\n", "before_files": [{"content": "# This file is part of Scapy\n# See http://www.secdev.org/projects/scapy for more information\n# Copyright (C) Philippe Biondi <phil@secdev.org>\n# This program is published under a GPLv2 license\n\n\"\"\"\nFunctions common to different architectures\n\"\"\"\n\nimport ctypes\nimport os\nimport socket\nimport struct\nimport subprocess\nimport time\nfrom ctypes import POINTER, Structure\nfrom ctypes import c_uint, c_uint32, c_ushort, c_ubyte\nfrom scapy.consts import WINDOWS\nfrom scapy.config import conf\nfrom scapy.data import MTU\nfrom scapy.error import Scapy_Exception\nimport scapy.modules.six as six\n\nif not WINDOWS:\n    from fcntl import ioctl\n\n# BOOT\n\n\ndef _check_tcpdump():\n    \"\"\"\n    Return True if the tcpdump command can be started\n    \"\"\"\n    try:\n        proc = subprocess.Popen(\n            [conf.prog.tcpdump, \"--version\"],\n            stdout=subprocess.PIPE,\n            stderr=subprocess.STDOUT\n        )\n        output = proc.communicate()[0]\n    except OSError:\n        return False\n\n    # On some systems, --version does not exist on tcpdump\n    return proc.returncode == 0 or output.startswith(b'Usage: tcpdump ')\n\n\n# This won't be used on Windows\nTCPDUMP = WINDOWS or _check_tcpdump()\n\n# UTILS\n\n\ndef get_if(iff, cmd):\n    \"\"\"Ease SIOCGIF* ioctl calls\"\"\"\n\n    sck = socket.socket()\n    ifreq = ioctl(sck, cmd, struct.pack(\"16s16x\", iff.encode(\"utf8\")))\n    sck.close()\n    return ifreq\n\n\ndef get_if_raw_hwaddr(iff):\n    \"\"\"Get the raw MAC address of a local interface.\n\n    This function uses SIOCGIFHWADDR calls, therefore only works\n    on some distros.\n\n    :param iff: the network interface name as a string\n    :returns: the corresponding raw MAC address\n    \"\"\"\n    from scapy.arch import SIOCGIFHWADDR\n    return struct.unpack(\"16xh6s8x\", get_if(iff, SIOCGIFHWADDR))\n\n# SOCKET UTILS\n\n\ndef _select_nonblock(sockets, remain=None):\n    \"\"\"This function is called during sendrecv() routine to select\n    the available sockets.\n    \"\"\"\n    # pcap sockets aren't selectable, so we return all of them\n    # and ask the selecting functions to use nonblock_recv instead of recv\n    def _sleep_nonblock_recv(self):\n        res = self.nonblock_recv()\n        if res is None:\n            time.sleep(conf.recv_poll_rate)\n        return res\n    # we enforce remain=None: don't wait.\n    return sockets, _sleep_nonblock_recv\n\n# BPF HANDLERS\n\n\nclass bpf_insn(Structure):\n    \"\"\"\"The BPF instruction data structure\"\"\"\n    _fields_ = [(\"code\", c_ushort),\n                (\"jt\", c_ubyte),\n                (\"jf\", c_ubyte),\n                (\"k\", c_uint32)]\n\n\nclass bpf_program(Structure):\n    \"\"\"\"Structure for BIOCSETF\"\"\"\n    _fields_ = [(\"bf_len\", c_uint),\n                (\"bf_insns\", POINTER(bpf_insn))]\n\n\ndef _legacy_bpf_pointer(tcpdump_lines):\n    \"\"\"Get old-format BPF Pointer. Deprecated\"\"\"\n    X86_64 = os.uname()[4] in ['x86_64', 'aarch64']\n    size = int(tcpdump_lines[0])\n    bpf = b\"\"\n    for l in tcpdump_lines[1:]:\n        if six.PY2:\n            int_type = long  # noqa: F821\n        else:\n            int_type = int\n        bpf += struct.pack(\"HBBI\", *map(int_type, l.split()))\n\n    # Thanks to http://www.netprojects.de/scapy-with-pypy-solved/ for the pypy trick  # noqa: E501\n    if conf.use_pypy:\n        str_buffer = ctypes.create_string_buffer(bpf)\n        return struct.pack('HL', size, ctypes.addressof(str_buffer))\n    else:\n        # XXX. Argl! We need to give the kernel a pointer on the BPF,\n        # Python object header seems to be 20 bytes. 36 bytes for x86 64bits arch.  # noqa: E501\n        if X86_64:\n            return struct.pack(\"HL\", size, id(bpf) + 36)\n        else:\n            return struct.pack(\"HI\", size, id(bpf) + 20)\n\n\ndef get_bpf_pointer(tcpdump_lines):\n    \"\"\"Create a BPF Pointer for TCPDump filter\"\"\"\n    if conf.use_pypy:\n        return _legacy_bpf_pointer(tcpdump_lines)\n\n    # Allocate BPF instructions\n    size = int(tcpdump_lines[0])\n    bpf_insn_a = bpf_insn * size\n    bip = bpf_insn_a()\n\n    # Fill the BPF instruction structures with the byte code\n    tcpdump_lines = tcpdump_lines[1:]\n    i = 0\n    for line in tcpdump_lines:\n        values = [int(v) for v in line.split()]\n        bip[i].code = c_ushort(values[0])\n        bip[i].jt = c_ubyte(values[1])\n        bip[i].jf = c_ubyte(values[2])\n        bip[i].k = c_uint(values[3])\n        i += 1\n\n    # Create the BPF program\n    return bpf_program(size, bip)\n\n\ndef compile_filter(bpf_filter, iface=None):\n    \"\"\"Asks Tcpdump to parse the filter, then build the matching\n    BPF bytecode using get_bpf_pointer.\n    \"\"\"\n    if not TCPDUMP:\n        raise Scapy_Exception(\"tcpdump is not available. Cannot use filter !\")\n    try:\n        process = subprocess.Popen([\n            conf.prog.tcpdump,\n            \"-p\",\n            \"-i\", (conf.iface if iface is None else iface),\n            \"-ddd\",\n            \"-s\", str(MTU),\n            bpf_filter],\n            stdout=subprocess.PIPE,\n            stderr=subprocess.PIPE\n        )\n    except OSError as ex:\n        raise Scapy_Exception(\"Failed to attach filter: %s\" % ex)\n    lines, err = process.communicate()\n    ret = process.returncode\n    if ret:\n        raise Scapy_Exception(\n            \"Failed to attach filter: tcpdump returned: %s\" % err\n        )\n    lines = lines.strip().split(b\"\\n\")\n    return get_bpf_pointer(lines)\n", "path": "scapy/arch/common.py"}], "after_files": [{"content": "# This file is part of Scapy\n# See http://www.secdev.org/projects/scapy for more information\n# Copyright (C) Philippe Biondi <phil@secdev.org>\n# This program is published under a GPLv2 license\n\n\"\"\"\nFunctions common to different architectures\n\"\"\"\n\nimport ctypes\nimport os\nimport socket\nimport struct\nimport subprocess\nimport time\nfrom ctypes import POINTER, Structure\nfrom ctypes import c_uint, c_uint32, c_ushort, c_ubyte\nfrom scapy.consts import WINDOWS\nfrom scapy.config import conf\nfrom scapy.data import MTU\nfrom scapy.error import Scapy_Exception\nimport scapy.modules.six as six\n\nif not WINDOWS:\n    from fcntl import ioctl\n\n# BOOT\n\n\ndef _check_tcpdump():\n    \"\"\"\n    Return True if the tcpdump command can be started\n    \"\"\"\n    try:\n        proc = subprocess.Popen(\n            [conf.prog.tcpdump, \"--version\"],\n            stdout=subprocess.PIPE,\n            stderr=subprocess.STDOUT\n        )\n        output = proc.communicate()[0]\n    except OSError:\n        return False\n\n    # On some systems, --version does not exist on tcpdump\n    return proc.returncode == 0 \\\n        or output.startswith(b'Usage: tcpdump ') \\\n        or output.startswith(b'tcpdump: unrecognized option')\n\n\n# This won't be used on Windows\nTCPDUMP = WINDOWS or _check_tcpdump()\n\n# UTILS\n\n\ndef get_if(iff, cmd):\n    \"\"\"Ease SIOCGIF* ioctl calls\"\"\"\n\n    sck = socket.socket()\n    ifreq = ioctl(sck, cmd, struct.pack(\"16s16x\", iff.encode(\"utf8\")))\n    sck.close()\n    return ifreq\n\n\ndef get_if_raw_hwaddr(iff):\n    \"\"\"Get the raw MAC address of a local interface.\n\n    This function uses SIOCGIFHWADDR calls, therefore only works\n    on some distros.\n\n    :param iff: the network interface name as a string\n    :returns: the corresponding raw MAC address\n    \"\"\"\n    from scapy.arch import SIOCGIFHWADDR\n    return struct.unpack(\"16xh6s8x\", get_if(iff, SIOCGIFHWADDR))\n\n# SOCKET UTILS\n\n\ndef _select_nonblock(sockets, remain=None):\n    \"\"\"This function is called during sendrecv() routine to select\n    the available sockets.\n    \"\"\"\n    # pcap sockets aren't selectable, so we return all of them\n    # and ask the selecting functions to use nonblock_recv instead of recv\n    def _sleep_nonblock_recv(self):\n        res = self.nonblock_recv()\n        if res is None:\n            time.sleep(conf.recv_poll_rate)\n        return res\n    # we enforce remain=None: don't wait.\n    return sockets, _sleep_nonblock_recv\n\n# BPF HANDLERS\n\n\nclass bpf_insn(Structure):\n    \"\"\"\"The BPF instruction data structure\"\"\"\n    _fields_ = [(\"code\", c_ushort),\n                (\"jt\", c_ubyte),\n                (\"jf\", c_ubyte),\n                (\"k\", c_uint32)]\n\n\nclass bpf_program(Structure):\n    \"\"\"\"Structure for BIOCSETF\"\"\"\n    _fields_ = [(\"bf_len\", c_uint),\n                (\"bf_insns\", POINTER(bpf_insn))]\n\n\ndef _legacy_bpf_pointer(tcpdump_lines):\n    \"\"\"Get old-format BPF Pointer. Deprecated\"\"\"\n    X86_64 = os.uname()[4] in ['x86_64', 'aarch64']\n    size = int(tcpdump_lines[0])\n    bpf = b\"\"\n    for l in tcpdump_lines[1:]:\n        if six.PY2:\n            int_type = long  # noqa: F821\n        else:\n            int_type = int\n        bpf += struct.pack(\"HBBI\", *map(int_type, l.split()))\n\n    # Thanks to http://www.netprojects.de/scapy-with-pypy-solved/ for the pypy trick  # noqa: E501\n    if conf.use_pypy:\n        str_buffer = ctypes.create_string_buffer(bpf)\n        return struct.pack('HL', size, ctypes.addressof(str_buffer))\n    else:\n        # XXX. Argl! We need to give the kernel a pointer on the BPF,\n        # Python object header seems to be 20 bytes. 36 bytes for x86 64bits arch.  # noqa: E501\n        if X86_64:\n            return struct.pack(\"HL\", size, id(bpf) + 36)\n        else:\n            return struct.pack(\"HI\", size, id(bpf) + 20)\n\n\ndef get_bpf_pointer(tcpdump_lines):\n    \"\"\"Create a BPF Pointer for TCPDump filter\"\"\"\n    if conf.use_pypy:\n        return _legacy_bpf_pointer(tcpdump_lines)\n\n    # Allocate BPF instructions\n    size = int(tcpdump_lines[0])\n    bpf_insn_a = bpf_insn * size\n    bip = bpf_insn_a()\n\n    # Fill the BPF instruction structures with the byte code\n    tcpdump_lines = tcpdump_lines[1:]\n    i = 0\n    for line in tcpdump_lines:\n        values = [int(v) for v in line.split()]\n        bip[i].code = c_ushort(values[0])\n        bip[i].jt = c_ubyte(values[1])\n        bip[i].jf = c_ubyte(values[2])\n        bip[i].k = c_uint(values[3])\n        i += 1\n\n    # Create the BPF program\n    return bpf_program(size, bip)\n\n\ndef compile_filter(bpf_filter, iface=None):\n    \"\"\"Asks Tcpdump to parse the filter, then build the matching\n    BPF bytecode using get_bpf_pointer.\n    \"\"\"\n    if not TCPDUMP:\n        raise Scapy_Exception(\"tcpdump is not available. Cannot use filter !\")\n    try:\n        process = subprocess.Popen([\n            conf.prog.tcpdump,\n            \"-p\",\n            \"-i\", (conf.iface if iface is None else iface),\n            \"-ddd\",\n            \"-s\", str(MTU),\n            bpf_filter],\n            stdout=subprocess.PIPE,\n            stderr=subprocess.PIPE\n        )\n    except OSError as ex:\n        raise Scapy_Exception(\"Failed to attach filter: %s\" % ex)\n    lines, err = process.communicate()\n    ret = process.returncode\n    if ret:\n        raise Scapy_Exception(\n            \"Failed to attach filter: tcpdump returned: %s\" % err\n        )\n    lines = lines.strip().split(b\"\\n\")\n    return get_bpf_pointer(lines)\n", "path": "scapy/arch/common.py"}]}