capture-pcap.py

#!/usr/bin/python

import sys,socket,struct,time

snaplen = 65535
try: iface = sys.argv[1]
except IndexError:
    sys.stderr.write("Usage: %s <interface> >output.pcap\n"%(sys.argv[0]))
    raise SystemExit(1)

sock = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.htons(3))
sock.bind((iface, 0))

pkt_hdr = struct.Struct('>4L')

# magic, version, tz gmt diff, time accuracy, snaplen, datalink type
sys.stdout.write(struct.pack(">LHHLLLL",  0xa1b2c3d4, 2, 4, 0, 0, snaplen, 1))
sys.stdout.flush()

while True:
    data = sock.recv(snaplen)
    timestamp = time.time()
    sys.stdout.write(pkt_hdr.pack(int(timestamp), int(timestamp*10e6-int(timestamp)*10e6), len(data), len(data)))
    sys.stdout.write(data)
    sys.stdout.flush()