Quick cheat for tcpdump cpature and view

packetcap.py

"""
Quick cheat for tcpdump capture and view

    packetcap.py capture [-I interface] [-P portslist] PCAPFILE
    packetcap.py view [--no-resolve-names|-N] PCAPFILE

To just start capturing packets to a file, run

    python3 packetcap.py capture my-packets.pcap

If you are interested in a specific port, specify them - for example for common HTTP ports

    python3 packetcap.py capture my-packets.pcap -P 80,8080,8090

To view, use

    python3 packetcap.py view my-packets.pcap
    #python3 packetcap.py view my-packets.pcap | less  #  -- on Linux, or Powershell with coreutils

Any names that can be resolved will be resolved. To prevent this, use the `-N` option

"""

from argparse import ArgumentParser
import os
import shlex


def parseargs():
    parser = ArgumentParser()
    action = parser.add_subparsers(dest="action")

    cap_p = action.add_parser("capture")
    cap_p.add_argument("file")
    cap_p.add_argument("--interface", "-I", default="any")
    cap_p.add_argument("--ports", "-P", default="")

    view_p = action.add_parser("view")
    cap_p.add_argument("file")
    view_p.add_argument("--no-resolve-names", "-N")

    args = parser.parse_args()
    args.ports = [int(n) for n in args.ports] if args.ports else None

    return args


def main():
    args = parseargs()

    # ---- construct ...

    command = ["tcpdump"]

    if args.action == "capture":
        command.extend(["-i", args.interface, "-w", args.file])
        if args.ports:
            command.extend((" or ".join([f"port {p}" for p in args.ports])).split())

    elif args.action == "view":
        command.extend(["-r", args.file])
        if args.no_resolve_names:
            command.append("-nn")

    # ---- ... and dispatch

    os.system(shlex.join(command))


if __name__ == "__main__":
    main()