the filter of sniff function in scapy does not work properly

Question

It seems that the filter of sniff function does not work properly.

I m executing the sniff with the following filter

a=sniff(co         


        

Answer 1

There are known bugs with the filter function (especially when using the local loopback network!). It is advised to use lfilter (and depending on your needs also a stop_filter):

Example usage: lfilter=lambda p: any(proto in [14010]) for proto in [TCP]), stop_filter =lambda x: x.haslayer(TCP)

For more details on the lfilter see also: https://home.regit.org/2012/06/using-scapy-lfilter/