Outgoing UDP sniffer in python?
- by twneale
I want to figure out whether my computer is somehow causing a UDP flood that is originating from my network. So that's my underlying problem, and what follows is simply my non-network-person attempt to hypothesize a solution using python. I'm extrapolating from recipe 13.1 ("Passing Messages with Socket Datagrams") from the python cookbook (also here).
Would it possible/sensible/not insane to try somehow writing an outgoing UDP proxy in python, so that outgoing packets could be logged before being sent on their merry way? If so, how would one go about it? Based on my quick research, perhaps I could start a server process listening on suspect UDP ports and log anything that gets sent, then forward it on, such as:
import socket
s =socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.bind(("", MYPORT))
while True:
packet = dict(zip('data', 'addr'), s.recvfrom(1,024))
log.info("Recieved {data} from {addr}.".format(**packet))
But what about doing this for a large number of ports simultaneously? Impractical? Are there drawbacks or other reasons not to bother with this? Is there a better way to solve this problem (please be gentle).
