TCP connection state from RAW SOCKET packet sniffing

Question

Here is my code:

ins = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 3)
ins.setsockopt(socket.SOL_SOCKET, socket.SO_RCVBUF, 2**30)
ins.bind((interface_name, 3))

while True:
    fmt = "B"*7+"I"*21
    pkt, sa_ll = self.ins.recvfrom(65535)
    x = struct.unpack(fmt, ins.getsockopt(socket.IPPROTO_TCP, socket.TCP_INFO, 92))
    print "===>",x
    print "HEX Packet",hexlify(pkt)
    process_ipframe(sa_ll[2],hexlify(pkt))

Getting socket.error: [Errno 92] Protocol not available error. Or is there any better way to get the TCP(Need only ESTAB connctions) states for the connections.

Maybe, in this link you can find an answer: [http://stackoverflow.com/questions/37514180/python-server-socket-error-errno-92-protocol-not-available](http://stackoverflow.com/questions/37514180/python-server-socket-error-errno-92-protocol-not-available) — Tunahan, Dec 27 '16 at 07:29

score 1 · Accepted Answer · edited May 23 '17 at 12:08

Ok, my requirement is to get the established connections. But I was sniffing traffic on the interface for other purpose. So, I though I could get TCP states from raw sockets. But I found /proc/net/tcp: there is st field, from that I can get ESTABLISHED connections. So, I should read /proc/net/tcp continuously to get ESTAB for a specific time in different thread.

So, the answer is /proc/net/tcp. Check this question. or may I should use netfilter

TCP connection state from RAW SOCKET packet sniffing

1 Answers1