Raw sockets in python3

Question

I want to write a packet sniffer that sniffs all incoming TCP packets.In one of the examples that I was looking instead of using SOCK_RAW instead of SOCK_STREAM?

try:
    s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
except socket.error as e:
    print('Socket creation failed. Error Code {} Message {}'.format(str(e[0]),str(e[1])))
    sys.exit()

#Include IP headers
s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)
packet = s.recvfrom(65565)

1) In the above case can I use SOCK_STREAM instead of SOCK_RAW. 2) What does recvfrom(65565) mean ? Does it mean recvfrom all TCP ports instead of a specific TCP port?

Answer 1

1. If you use SOCK_STREAM instead of SOCK_RAW you won't be able to read the protocols headers, but only the data transmitted via TCP. In the other hand, SOCK_RAW will give you access to the full packet headers. In your case, as you want to build your own protocol analyzer (sniffer), SOCK_RAW should be your choice.

2. The method definition for recvfrom is:

   socket.recvfrom(bufsize[, flags])

   Receive data from the socket. The return value is a pair (string, address) where string is a string representing the data received and address is the address of the socket sending the data

This method simply receives maximum bufsize bytes from the socket.