A Linux network packet sniffer and protocol analyzer built with raw sockets (AF_PACKET). Captures and dissects Layer 3/4 headers (IPv4, TCP, UDP, ICMP), generates hex dumps, and queries IP reputation intelligence via AbuseIPDB.
- Raw Socket Capture: Captures Layer 2 Ethernet frames and Layer 3 IPv4 packets directly using Linux
AF_PACKETraw sockets. - Protocol Decoding: Unpacks and decodes TCP flags, sequence/ack numbers, window sizes, UDP datagrams, and ICMP control types (Echo Request/Reply, TTL Exceeded, Destination Unreachable).
- Flexible Export: Formats packet metadata to clean JSON, CSV, or human-readable plaintext logs.
- Hex Dump Analysis: Optional byte-level hex dump representation of packet payload data.
- Abuse Intelligence: Automated AbuseIPDB reputation lookups for remote destination IPs.
- Linux OS with
CAP_NET_RAWcapability or root privileges - Python 3.8+
- Dependencies:
pip install requests hexdump
Note
Capturing packets with raw sockets requires root privileges. Run with sudo.
Capture all packets across all available interfaces:
sudo python3 so1dump.pyCapture only TCP traffic and print full payload hex dumps:
sudo python3 so1dump.py -p tcp -XCapture packets on interface eth0 and export formatted records to JSON:
sudo python3 so1dump.py -i eth0 -f json -n capture.jsonEnable AbuseIPDB reputation queries (set ABUSEIPDB_API_KEY in your environment):
export ABUSEIPDB_API_KEY="your_api_key_here"
sudo -E python3 so1dump.py -p all -a| Flag | Description | Default |
|---|---|---|
-p, --protocol |
Protocol filter (all, tcp, udp, icmp) |
all |
-i, --interface |
Network interface to bind (e.g. eth0, all) |
all |
-f, --file |
Export format (json, csv, txt) |
None |
-n, --name |
Output file path | None |
-X, --hex-dump |
Display raw byte hex dump of payload | Disabled |
-a, --abuse-check |
Query AbuseIPDB for IP reputation scores | Disabled |
--quiet |
Suppress stdout; write only to target file | Disabled |
MIT License. See LICENSE for details.