Confusion with POpen/stdin/scapy/tcpreplay

Question

I'm trying to emulate the code here: Scapy and tcpreplay: bypass temporary file for performance

When I try running that code, Python errors on this line:

    f = subprocess.Popen(argv, stdin=subprocess.PIPE)

The error says

Failed: Error opening pcap file: truncated dump file; tried to read 4 file header bytes, only got 0

I think I'm getting that error because the subprocess is trying to read from stdin before anything is written to stdin.

Any suggestions?

Answer 1

Got it to work... used this header instead of the header in the quoted answer:

header = b'\xd4\xc3\xb2\xa1\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\x7f\x00\x00\x01\x00\x00\x00'

I didn't end up using sendpfast in my code.

To clarify my problem above... I was trying to send 1 packet, update the packet's IP, then send the updated packet in a loop.

Writing a list of packets to stdin, then using sendpfast wasn't any faster than writing a list of packets to a temp file, then using sendpfast on the temp file. Sendpfast seems to be only good for sending a bunch of packets from a pcap file already on disk.

This link (https://byt3bl33d3r.github.io/mad-max-scapy-improving-scapys-packet-sending-performance.html) provided the best solution for my problem. It allowed me to open a socket, send a single packet on that socket, update the packet, then send via the same socket.