sisniff
-------

Sisniff is a network sniffer like tcpdump, which prints out all the packets on a network interface from and to the local computer.<br>
As a special feature, **for each packet the coresponding application sending or receiving this packet is displayed**.<br>
With filter options like program name a specific application can be tracked.<br>


It supports TCP, UDP and ICMP packets, both on IPv4 and IPv6<br>
All BPF-Filter on top of IP which can be used by tcpdump are also supported.<br>
<p>

For HTTP connections, there is an argument (<code>-H resp. -Hl</code>) to show short or long payload.<br>

 
Under some cirumstances the program/PID cannot be evaluated. This mavericks would be reported as follow:
<pre>
 "?/?" = No entry in /proc/net/[TCP/UDP/ICMP]
 "-/-" = Found Inode but no PID
 "./." = The Inode found is '0'
</pre>
 

<p><i>
!! sisniff uses scapy's sniff() function, so scapy package is needed:<br>
!! debian: apt-get install scapy<br>
!! pip: pip/pip3 install scapy<br>
!! other systems: http://www.secdev.org/projects/scapy<br>
</i>


This program needs Python 3.x or Python 2.x. 
 
 
Homepage (german): https://wiki.zweiernet.ch/wiki/sisniff

Direct Download: `wget https://git.zweiernet.ch/sigi/sisniff/raw/master/sisniff` 
 
 
<pre>
--------------------
# sisniff -h
usage: sisniff [-h] -i {eth0,lo,wlan0} [-n] [-P] [-p program|not-program] [-4] [-6] [-H] [-Hl] [filter]

sisniff V1.5
2017-2023 by sigi <https://wiki.zweiernet.ch/wiki/sisniff>

positional arguments:
  filter                Filter (BPF syntax) on top of IP (in dbl-quotes "...")

optional arguments:
  -h, --help            show this help message and exit
  -i {eth0,lo,wlan0}    Interface
  -n                    Do not resolve IP-Addresses
  -P                    Don't put interface into promiscuous mode
  -p program|not-program
                        Filter by program name (accepts * for matching) ([not-] negates)
  -4                    Only IPv4
  -6                    Only IPv6
  -H                   Show HTTP Payload
  -Hl                  Show HTTP Payload, long output
--------------------
</pre>

* Interfaces showed in the help are gathered from the running system.
* <code>program</code> is meant the base name of the program/application, e.g. <code>-p thunderbird-bin</code>
* <code>program</code> can contain '*' pattern at the beginning and/or the end, e.g. <code>-p thunder&#42;</code>
* <code>not-program</code> excludes the program from beeing showed, e.g. <code>not-thunderbird-bin</code>. The '*' pattern also is accepted.
* <code>filter</code> is in same syntax as tcpdump uses. Must be written in double-quotes "..."


##### Example Commands
<pre>
# sisniff "port not ssh"
# sisniff -p *vpn*
# sisniff -i wlan0 -p not-thunderbird-bin -4 "host not www.zweiernet.ch"
# sisniff -i eth0 -p firefox -Hl "port 80"		
</pre>


##### Example Output

![ ](https://git.zweiernet.ch/sigi/sisniff/raw/master/Terminal_059.png)