Repository: secdev/scapy

Issue:
tcpdump check error in centos
#### Brief description

> I have installed tcpdump in PATH, but it reports:
scapy.error.Scapy_Exception: tcpdump is not available. Cannot use filter !
I found the code which check tcudmp in /opt/rh/rh-python36/root/usr/lib/python3.6/site-packages/scapy/arch/common.py:

```
def _check_tcpdump():
    """
    Return True if the tcpdump command can be started
    """
    with open(os.devnull, 'wb') as devnull:
        try:
            proc = subprocess.Popen([conf.prog.tcpdump, "--version"],
                                    stdout=devnull, stderr=subprocess.STDOUT)
        except OSError:
            return False
    return proc.wait() == 0
```


the error is that tcpdump --version return 1 instead of 0
eg:
```
[root@localhost proxy]# tcpdump --version
tcpdump version 4.1-PRE-CVS_2017_03_21
libpcap version 1.4.0
Usage: tcpdump [-aAdDefhIJKlLnNOpqRStuUvxX] [ -B size ] [ -c count ]
		[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]
		[ -i interface ] [ -j tstamptype ] [ -M secret ]
		[ -Q|-P in|out|inout ]
		[ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
		[ -W filecount ] [ -y datalinktype ] [ -z command ]
		[ -Z user ] [ expression ]
[root@localhost proxy]# echo $?
1
```

#### Environment

```
[root@localhost proxy]# python3.6 --version
Python 3.6.3
[root@localhost proxy]# pip3.6 freeze
certifi==2018.11.29
chardet==3.0.4
idna==2.8
protobuf==3.6.1
psutil==5.4.8
PyMySQL==0.9.3
redis==3.0.1
requests==2.21.0
s8-protocol==1.0
scapy==2.4.2
six==1.11.0
snakeMQ==1.6
urllib3==1.24.1
virtualenv==15.1.0
xlrd==1.2.0
You are using pip version 9.0.1, however version 19.0.2 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
[root@localhost proxy]# uname -a
Linux localhost.localdomain 2.6.32-431.el6.x86_64 #1 SMP Fri Nov 22 03:15:09 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost proxy]# cat /etc/issue
CentOS release 6.5 (Final)
Kernel \r on an \m
```



Discussion:
Hi !
This was fixed by https://github.com/secdev/scapy/commit/1515cbbe3062c6d87eac3368fca4cc5a257c2caa

Please use the development build (github)

(Feel free to reopen if you think that’s not it)
I also met this problem now, using master branch.



  File "/usr/lib/python2.7/site-packages/scapy-git_archive.devbe4ff41e3-py2.7.egg/scapy/sendrecv.py", line 1020, in sniff
    sniffer._run(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/scapy-git_archive.devbe4ff41e3-py2.7.egg/scapy/sendrecv.py", line 890, in _run
    *arg, **karg)] = iface
  File "/usr/lib/python2.7/site-packages/scapy-git_archive.devbe4ff41e3-py2.7.egg/scapy/arch/linux.py", line 475, in __init__
    attach_filter(self.ins, filter, iface)
  File "/usr/lib/python2.7/site-packages/scapy-git_archive.devbe4ff41e3-py2.7.egg/scapy/arch/linux.py", line 160, in attach_filter
    bp = compile_filter(bpf_filter, iface)
  File "/usr/lib/python2.7/site-packages/scapy-git_archive.devbe4ff41e3-py2.7.egg/scapy/arch/common.py", line 164, in compile_filter
    raise Scapy_Exception("tcpdump is not available. Cannot use filter !")
scapy.error.Scapy_Exception: tcpdump is not available. Cannot use filter !
Exception socket.error: error(99, 'Cannot assign requested address') in <bound method L2ListenSocket.__del__ of <scapy.arch.linux.L2ListenSocket object at 0x2b0e810>> ignored

I add two **'print'**, and I can show you the result as follow:

so I think this may be a bug :)


-------------------------------------------------------------------------

```
def _check_tcpdump():
    """
    Return True if the tcpdump command can be started
    """
    try:
        proc = subprocess.Popen(
            [conf.prog.tcpdump, "--version"],
            stdout=subprocess.PIPE,
            stderr=subprocess.STDOUT
        )
        output = proc.communicate()[0]
    except OSError:
        return False

    # On some systems, --version does not exist on tcpdump
    print proc.returncode
    print output
    return proc.returncode == 0 or output.startswith(b'Usage: tcpdump ')
```

----------------------------------------------------------------------------------------

```
1
tcpdump: unrecognized option '--version'
tcpdump version 4.5.1
libpcap version 1.5.3
Usage: tcpdump [-aAbdDefhHIJKlLnNOpqRStuUvxX] [ -B size ] [ -c count ]
                [ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]
                [ -i interface ] [ -j tstamptype ] [ -M secret ]
                [ -P in|out|inout ]
                [ -r file ] [ -s snaplen ] [ -T type ] [ -V file ] [ -w file ]
                [ -W filecount ] [ -y datalinktype ] [ -z command ]
                [ -Z user ] [ expression ]
```

----------------------------------------------------------------------------
After I  change 

`return proc.returncode == 0 or output.startswith(b'Usage: tcpdump ')`

to

`return True`

, Scapy is running like a happy child :)

Thanks to @abc19899 for your clues!
@guedou please have a look. I got the ping

Resolving patch:
diff --git a/scapy/arch/common.py b/scapy/arch/common.py
--- a/scapy/arch/common.py
+++ b/scapy/arch/common.py
@@ -42,7 +42,9 @@ def _check_tcpdump():
         return False
 
     # On some systems, --version does not exist on tcpdump
-    return proc.returncode == 0 or output.startswith(b'Usage: tcpdump ')
+    return proc.returncode == 0 \
+        or output.startswith(b'Usage: tcpdump ') \
+        or output.startswith(b'tcpdump: unrecognized option')
 
 
 # This won't be used on Windows


Test patch: