pyshark icon indicating copy to clipboard operation
pyshark copied to clipboard

LiveRingCapture -> tshark: Multiple capture files requested, but a capture isn't being.

Open airvzxf opened this issue 3 years ago • 0 comments

Summary

Trying to capture on live. I replicate the example in the GitHub page, but it returns the error tshark: Multiple capture files requested, but a capture isn't being.

capture = pyshark.LiveCapture(interface='eth0')
capture.sniff(timeout=50)

Steps to reproduce

main.py

from pyshark import LiveRingCapture

if __name__ == '__main__':
    capture = LiveRingCapture(interface='enp4s0', debug=True)
    capture.sniff(timeout=500)

Then I run the Python script as a root: sudo python3 main.py.

What is the current bug behavior?

It throws the error tshark: Multiple capture files requested, but a capture isn't being.

What is the expected correct behavior?

Capture something at least.

Sample capture file

Not capture's file.

Relevant logs and/or screenshots

2021-06-03 11:37:08,918 - LiveRingCapture - DEBUG - Creating Dumpcap subprocess with parameters: /usr/bin/dumpcap -q -i enp4s0 -w -
2021-06-03 11:37:08,919 - LiveRingCapture - DEBUG - Dumpcap subprocess created
2021-06-03 11:37:08,919 - LiveRingCapture - DEBUG - Creating TShark subprocess with parameters: /usr/bin/tshark -l -n -T pdml -r - -b filesize:1024 -b files:1 -w /tmp/pyshark.pcap -P
2021-06-03 11:37:08,919 - LiveRingCapture - DEBUG - Executable: /usr/bin/tshark
2021-06-03 11:37:08,921 - LiveRingCapture - DEBUG - TShark subprocess created
2021-06-03 11:37:08,921 - LiveRingCapture - DEBUG - Starting to go through packets
Capturing on 'enp4s0'
Running as user "root" and group "root". This could be dangerous.
File: -
tshark: Multiple capture files requested, but a capture isn't being done.
2021-06-03 11:37:09,042 - LiveRingCapture - DEBUG - EOF reached
dumpcap: The file to which the capture was being saved
("-") could not be closed: Broken pipe.
Please report this to the Wireshark developers as a bug.
https://gitlab.com/wireshark/wireshark/issues
(This is not a crash; please do not say, in your report, that it is a crash.)
Packets captured: 1
Packets received/dropped on interface 'enp4s0': 1/0 (pcap:0/dumpcap:0/flushed:0/ps_ifdrop:0) (100.0%)

Tracking the Python error:

Traceback (most recent call last):
  File "/home/wolf/workspace/projects/ark-game-read-network-packages/src/main.py", line 19, in <module>
    SpyNetwork(interface).start()
  File "/home/wolf/workspace/projects/ark-game-read-network-packages/src/core/spy_network.py", line 36, in start
    capture.sniff(timeout=50)
  File "/home/wolf/workspace/projects/ark-game-read-network-packages/src/venv/lib/python3.9/site-packages/pyshark/capture/capture.py", line 137, in load_packets
    self.apply_on_packets(keep_packet, timeout=timeout, packet_count=packet_count)
  File "/home/wolf/workspace/projects/ark-game-read-network-packages/src/venv/lib/python3.9/site-packages/pyshark/capture/capture.py", line 274, in apply_on_packets
    return self.eventloop.run_until_complete(coro)
  File "/usr/lib/python3.9/asyncio/base_events.py", line 642, in run_until_complete
    return future.result()
  File "/usr/lib/python3.9/asyncio/tasks.py", line 481, in wait_for
    return fut.result()
  File "/home/wolf/workspace/projects/ark-game-read-network-packages/src/venv/lib/python3.9/site-packages/pyshark/capture/capture.py", line 290, in packets_from_tshark
    await self.close_async()
  File "/home/wolf/workspace/projects/ark-game-read-network-packages/src/venv/lib/python3.9/site-packages/pyshark/capture/capture.py", line 440, in close_async
    await self._cleanup_subprocess(process)
  File "/home/wolf/workspace/projects/ark-game-read-network-packages/src/venv/lib/python3.9/site-packages/pyshark/capture/capture.py", line 431, in _cleanup_subprocess
    raise TSharkCrashException("TShark seems to have crashed (retcode: %d). "
pyshark.capture.capture.TSharkCrashException: TShark seems to have crashed (retcode: 1). Try rerunning in debug mode [ capture_obj.set_debug() ] or try updating tshark.
Exception ignored in: <function Capture.__del__ at 0x7fa8392800d0>
Traceback (most recent call last):
  File "/home/wolf/workspace/projects/ark-game-read-network-packages/src/venv/lib/python3.9/site-packages/pyshark/capture/capture.py", line 445, in __del__
  File "/home/wolf/workspace/projects/ark-game-read-network-packages/src/venv/lib/python3.9/site-packages/pyshark/capture/capture.py", line 436, in close
  File "/usr/lib/python3.9/asyncio/base_events.py", line 642, in run_until_complete
  File "/home/wolf/workspace/projects/ark-game-read-network-packages/src/venv/lib/python3.9/site-packages/pyshark/capture/capture.py", line 440, in close_async
  File "/home/wolf/workspace/projects/ark-game-read-network-packages/src/venv/lib/python3.9/site-packages/pyshark/capture/capture.py", line 431, in _cleanup_subprocess
pyshark.capture.capture.TSharkCrashException: TShark seems to have crashed (retcode: 1). Try rerunning in debug mode [ capture_obj.set_debug() ] or try updating tshark.

airvzxf avatar Jun 03 '21 16:06 airvzxf