karpierz/libpcap

Python binding for the libpcap C library.

libpcap's Issues

Using a backend different from npcap

There doesn't seem a way to specify programmatically to use a different backend. What's the simplest way to add this?

Changing the path manually in the code works, but I'm hoping for something that would work from a clean pip install.

I don't mind sending a pull-request for it myself, once we agree on the approach.

Linux find_library return relative path

Hi @karpierz,

I'm trying to use this python package on ARM64 and got issue importing my libpcap.so library.

In linux the find_library() return a relative path.
See: https://docs.python.org/3/library/ctypes.html#finding-shared-libraries

So this check is wrong :

libpcap/src/libpcap/_platform/_linux/__init__.py

Line 26 in e64a39f

if os.path.isabs(LIBPCAP):

Regards,
Clement

Release timeline

Greetings. I am considering to leverage this library as a dependency in another production library, and I am therefore curious if there are plans to make a stable release in the near future? Currently, all releases published so far appear to be tagged as beta.

Also, regarding this statement from the README:

ATTENTION: currently works and tested only for Windows.

I tested this wrapper on GNU/Linux extensively, and it appears to function as advertised. No issues were found, except that the documentation is lacking.

Are there plans to integrate a CI (and maybe even CD) pipeline?

Thanks.

No libpcap.so when installed through pip

I just installed libpcap using pip and get the following:

File "workdir/env/lib/python3.8/site-packages/pcaprecorder/pcaprecorder.py", line 14, in
import libpcap
File "workdir/env/lib/python3.8/site-packages/libpcap/init.py", line 7, in
from ._pcap import *
File "workdir/env/lib/python3.8/site-packages/libpcap/_pcap.py", line 75, in
from ._dll import dll
File "workdir/env/lib/python3.8/site-packages/libpcap/_dll.py", line 10, in
raise exc
File "workdir/env/lib/python3.8/site-packages/libpcap/_dll.py", line 8, in
dll = DLL(DLL_PATH)
File "/usr/lib/python3.8/ctypes/init.py", line 373, in init
self._handle = _dlopen(self._name, mode)
OSError: workdir/env/lib/python3.8/site-packages/libpcap/_platform/_linux/x64/tcpdump/libpcap.so: cannot open shared object file: No such file or directory

When I browse the source on Github I can see that the file is included, and symlinking it to my system library seems to work. Is the intention that the library should be included when installing through pip?

You do mention this library in the doc but it's unclear if it concerns me as a user, or if it's aimed at distribution maintainers:

Note to Linux distributions and *BSD systems that include libpcap:

There's now a rule to make a shared library, which should work on Linux and *BSD, among other platforms.

It sets the soname of the library to "libpcap.so.1"; this is what it should be, NOT libpcap.so.1.x or libpcap.so.1.x.y or something such as that.

We've been maintaining binary compatibility between libpcap releases for quite a while; there's no reason to tie a binary linked with libpcap to a particular release of libpcap.

Problem with set_immediate_mode for a not activated pcap_t struct. Error: Struct already activated.

Hi!
I am trying to program a capture script using libpcap library for python.
The problem is when I try to activate immediate mode, if gives me the following error:

ERROR = b"The setting can't be changed after the pcap_t is activated"

Some of my code:

`

 #Initialize pcap_t
 func_pcap_t = libpcap.pcap_t()

#Set immediate mode to make timeout work:
if func_wrongSystemConfig == False:
    intRes = libpcap.set_immediate_mode(ctypes.byref(func_pcap_t), ctypes.c_int(1))
	
    if intRes != 0: #Error
        print("ERROR -  Not possible to set immediate mode!")
        p_errBuff = libpcap.statustostr(intRes)
        print("ERROR = ", repr(p_errBuff))
        
        func_wrongSystemConfig = True
  
  
  #Open Live Interface with promiscuous mode	
if func_wrongSystemConfig == False:
	
	#pcap_t *pcap_open_live(char *device, int snaplen, int promisc, int to_ms, char *ebuf)
	pcap_device = ctypes.c_char_p(if_name.encode(gl_pcap_encode))
	pcap_snaplen = ctypes.c_int(func_pcap_snaplen)
	pcap_promisc = ctypes.c_int(func_pacp_promisc)
	pcap_timeout = ctypes.c_int(func_pcap_timeout)
	
	func_pcap_t = libpcap.open_live(pcap_device, pcap_snaplen, pcap_promisc, pcap_timeout, p_errBuff)
	
	if not func_pcap_t:
		print("ERROR - Could not open live device: ", if_name)
		print("DEBUG - errBuf = ", repr(p_errBuff.value))
		func_wrongSystemConfig = True
	else:
		pass
		#print("SUCCESS - Opening live device: ", if_name) 

`

I also tried to set immediate mode after open_live but gives the same error...
What am I doing wrong and how can I fix this issue?
The struct pcap_t seems to do not activated but the function does not think so.

Windows Server compatibility

Has the library been tested against Windows Server? Are there any major differences in DLL handling between the desktop Windows 10 and Windows Server 2019? I don't have much experience with Windows so I might be missing something obvious but my problem is that while the library seems to be working on a desktop Windows 8/10 (running via VirtualBox), on a Windows Server 2019 I consistently get this:

Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "<frozen importlib._bootstrap>", line 1007, in _find_and_load
  File "<frozen importlib._bootstrap>", line 986, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 680, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 790, in exec_module
  File "<frozen importlib._bootstrap>", line 228, in _call_with_frames_removed
  File "C:\Python39-x64\lib\site-packages\libpcap\__init__.py", line 7, in <module>
    from ._pcap      import * ; del _pcap      # noqa
  File "<frozen importlib._bootstrap>", line 1007, in _find_and_load
  File "<frozen importlib._bootstrap>", line 986, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 680, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 790, in exec_module
  File "<frozen importlib._bootstrap>", line 228, in _call_with_frames_removed
  File "C:\Python39-x64\lib\site-packages\libpcap\_pcap.py", line 70, in <module>
    from ._platform import is_windows, is_linux, defined
  File "<frozen importlib._bootstrap>", line 1007, in _find_and_load
  File "<frozen importlib._bootstrap>", line 986, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 680, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 790, in exec_module
  File "<frozen importlib._bootstrap>", line 228, in _call_with_frames_removed
  File "C:\Python39-x64\lib\site-packages\libpcap\_platform\__init__.py", line 27, in <module>
    from ._windows import DLL_PATH, DLL, dlclose, CFUNC
  File "<frozen importlib._bootstrap>", line 1007, in _find_and_load
  File "<frozen importlib._bootstrap>", line 986, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 680, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 790, in exec_module
  File "<frozen importlib._bootstrap>", line 228, in _call_with_frames_removed
  File "C:\Python39-x64\lib\site-packages\libpcap\_platform\_windows\__init__.py", line 31, in <module>
    raise OSError("Cannot find wpcap.dll library") from None
OSError: Cannot find wpcap.dll library

This is reproducible with Python 3.7, 3.8, and 3.9 in a virtualized AMD64 server.

The recipe to reproduce is:

pip install libpcap
python -c "import libpcap"

Some examples from Linux

Hi!

I'm trying to play with libpcap on Ubuntu 20, with tcpdump.

I have no experience with CFUNC and C Python bindings...
Can you give me a trick why I can't discover devices ?

import libpcap
libpcap.config(LIBPCAP="tcpdump")

libpcap.findalldevs()

Output

libpcap.findalldevs()
Traceback (most recent call last):
  File "<input>", line 1, in <module>
TypeError: required argument 'alldevsp' missing

The binding direct to C function is

findalldevs   = CFUNC(ct.c_int,
                      ct.POINTER(ct.POINTER(pcap_if_t)),
                      ct.c_char_p)(
                      ("pcap_findalldevs", dll), (
                      (1, "alldevsp"),
                      (1, "errbuf"),))

why is falling?
I have tried this... but nothing...

a = POINTER(POINTER(libpcap.pcap_if_t))
b = c_char_p()
>>>libpcap.findalldevs(a,b)
Traceback (most recent call last):
  File "<input>", line 1, in <module>
ctypes.ArgumentError: argument 1: <class 'TypeError'>: expected LP_LP_pcap_if instance instead of _ctypes.PyCPointerType

I can offer a doc page with examples for future users on Linux, but I need to understand the bindings...

Many thanks for the work!

Do we support multi-process ?

Hello ,thanks for the great project.
Can i put the data capture using the libpcap in a standalone process with python multiprocessing lib?

libpcap inject or sendpacket function error "send: message too large" or "send: bad address"

Hi everybody.
I am using libpcap with Python 3 for a school projct.
I am trying to redirect the traffic in order to achieve a MITM attack after poisoning the ARP tables of a server and a client.
The problem is that the libpcap function sendpacket and inject give me the given errors for the given inputs:

ERROR - sending a packet with sendPacketPcapGlobal. ERROR - DEBUG - sendPacketPcapGlobal - str(''.join(pkt_data)).replace("0x","").replace(" ","") = 0242c0a878500242c0a878460800450801ac445140004006fb5bc0a87846c0a8783c8bcc9e786e6731e771b0bd2b801001fe737200000101080a6204a811ca8a402de54ee906b2ad20ab52f25d5b50a00b76f1b789e3e946a134cebd34fb470235022c56261d18dad73ede294a70a4dab1a8a6ada599cb93ee900b01a0f66bc68aa6954540c5669677f9786fef8d3c40f6117f13ca2e4eca706ca7ac2d60a5a548245ddb08b8f6b11ae97bdbf2e3c08114c2aa7c10abcbe704b06620027c3c56dae87948a6ab9e2620a4922865bab31237a8bdbd813c40f8ebcf4ecab245634324712d422862d7009000efe238e031552a9a71a099e2994522f96ea7f745877d35f6728ac411559838f4d6c41f87ce7bcf559d2d95b37d7bd6d1aef5a78c47ac091aeadbc0ec00ec4f7e612efd5a05ba23671359c1b92f29cb605664ce1d63a28dd6098ee58cdb19a9c3e0f3eb31c53463cddd778636f78ebadae6fa720b76c956f09d8441dbd3c6a734bbafc5380e8e9a27feb4b3ee6cca59963c3b29c74d4d414708a0afaa475dfe64ab7d850ebb4016b8f68e497bb365f9d2a52875270e83b680d9c5eaac5a4a81db899e1d1555343d4ac1ba5d8762547410 ERROR - DEBUG - sendPacketPcapGlobal - func_sizePacketDataInt = 442 ERROR - DEBUG - sendPacketPcapGlobal - resInt = -1 ERROR - Error Description: b'send: Bad address'

ERROR - sending a packet with sendPacketPcapGlobal. ERROR - DEBUG - sendPacketPcapGlobal - str(''.join(pkt_data)).replace("0x","").replace(" ","") = 0242c0a878500242c0a8784608004508febc448040004006fe1bc0a87846c0a8783c8bcc9e786e68335f71b0bd2b801801fe70830000010 IMAGINE MORE HEX VALUES HERE - Because GITHUB SAYS: "Comment is too long (maximum is 65536 characters)" ERROR - DEBUG - sendPacketPcapGlobal - func_sizePacketDataInt = 65226 ERROR - DEBUG - sendPacketPcapGlobal - resInt = -1 ERROR - Error Description: b'send: Message too large'

I set the snap length to more than 65226 bytes before activating the pcap_t object. Some code that could be helpful is the function used to inject/send the packet, which is the following:
(Sorry for the bad formatting, I could not get it to work properly...)
"CODE START"
`
def sendPacketPcapGlobal(pkt_data):
"""
sendPacketPcapGlobal sends the data contained in the call variable pkt_data using some global variables, which should be set before calling this function.
The global variables used by this function are:
gl_ifName (str) --> Name of the interface which will be used in order to send the packet
gl_ifNetworkMask (int) --> Network Mask of the interface which will be used in order to send the packet.

"""
global gl_ifNameStr, gl_ifNetworkMaskInt

func_ifName = gl_ifNameStr
func_ifNetworkMask = gl_ifNetworkMaskInt

#Initialize a pcap_t struct
#print("DEBUG - Starting myPcapLoop! \n dev = ", dev_Func, "\n idStr = ", idStr, "\n buf_Func = ", str(buf_Func))

#1. Create a pcap_t 
#pcap_t *pcap_create(const char *source, char *errbuf);
func_dev = ctypes.c_char_p(func_ifName.encode(gl_pcap_encode))
func_errBuff = ctypes.create_string_buffer(libpcap.PCAP_ERRBUF_SIZE)
func_pcap_t = libpcap.create(func_dev, func_errBuff)

if not func_pcap_t:
	print("ERROR - myPcapLoop could not create a pcap_t object for the device: ", dev_Func)
	return 1

#1.2 Set SnapLength
#func_pcap_snaplen = 65535
func_pcap_snaplen = 65535*2
pcap_snaplen = ctypes.c_int(func_pcap_snaplen)

#int pcap_set_snaplen(pcap_t *p, int snaplen);
intRes = libpcap.set_snaplen(func_pcap_t, pcap_snaplen)
if intRes !=0:
	print("ERROR - Setting snaplen for capturing data")
	



#2. Activate a pcap_t in order to be able to capture packets with it
#int pcap_activate(pcap_t *p);
activateInt = libpcap.activate(func_pcap_t)

#Activate returns 0 for succes:
if activateInt != 0:
	print("ERROR - Could NOT activate the pcap_t struct for the device = ", dev_Func)
	
	if activateInt == libpcap.PCAP_WARNING_PROMISC_NOTSUP:
		print("ERROR - PCAP_WARNING_PROMISC_NOTSUP - Promiscuous mode was requested, but the capture source doesn't support promiscuous mode. " )
	
	elif activateInt == libpcap.PCAP_WARNING_TSTAMP_TYPE_NOTSUP:
		print("ERROR - PCAP_WARNING_TSTAMP_TYPE_NOTSUP - The time stamp type specified in a previous pcap_set_tstamp_type(3PCAP) call isn't supported by the capture source (the time stamp type is left as the default),  ")
		
	elif activateInt == libpcap.PCAP_WARNING:
		print("ERROR - PCAP_WARNING - Another warnign occurred.")
		func_error =  libpcap.geterr(func_pcap_t)
		print("ERROR - ",str(func_error))
		
	elif activateInt == libpcap.PCAP_ERROR_ACTIVATED:
		print("ERROR - PCAP_ERROR_ACTIVATED - The handle has already been activated." )
		
	elif activateInt == libpcap.PCAP_ERROR_NO_SUCH_DEVICE:
		print("ERROR - PCAP_ERROR_NO_SUCH_DEVICE - The capture source specified when the handle was created doesn't exist. ")
		
	elif activateInt == libpcap.PCAP_ERROR_PERM_DENIED:
		print("ERROR - PCAP_ERROR_PERM_DENIED - The process doesn't have permission to open the capture source. ")
		
	elif activateInt == libpcap.PCAP_ERROR_PROMISC_PERM_DENIED:
		print("ERROR - PCAP_ERROR_PROMISC_PERM_DENIED - The process has permission to open the capture source but doesn't have permission to put it into promiscuous mode. " )
		
	elif activateInt == libpcap.PCAP_ERROR_RFMON_NOTSUP:
		print("ERROR - PCAP_ERROR_RFMON_NOTSUP - Monitor mode was specified but the capture source doesn't support monitor mode. " )
		
	elif activateInt == libpcap.PCAP_ERROR_IFACE_NOT_UP:
		print("ERROR - PCAP_ERROR_IFACE_NOT_UP - The capture source device is not up. ")
		
	elif activateInt == libpcap.PCAP_ERROR:
		print("ERROR - PCAP_ERROR - Another error occurred:")
		func_error =  libpcap.geterr(func_pcap_t)
		print("ERROR - ",str(func_error))
		
	else:
		print("ERROR - Unknow error for libpcap.activate() function")





#Fix the pkt_data if needed
func_pkt_data = str(''.join(pkt_data)).replace("0x","").replace(" ","")
#print("DEBUG - func_pkt_data = ", func_pkt_data)
func_sizePacketDataInt = math.ceil(len(func_pkt_data)/2)


#Store the packet data in a suitable variable to use the library libpcap
#Commented HERE - Possible error
#buf_pcap = (ctypes.c_ubyte*(func_sizePacketDataInt))(*bytes.fromhex(func_pkt_data.replace("0x","")))

#Pointer to packet data:
func_packetPointer = ctypes.cast(func_pkt_data, ctypes.POINTER(ctypes.c_ubyte))


#packetDataHex =  
#0242c0a878500242c0a8783c080045000083934740004006355ac0a8783cc0a87846d12200153e89599d41abd7ea801801f5724900000101080a89b2ac700d7890534d44544d2067616c6178792d6e61747572652d6165737468657469632d6261636b67726f756e642d7374617272792d736b792d6d6f756e7461696e2d72656d697865642d6d656469612e6a70670d0a

#0242c0a878500242c0a8784608004500006f7b044000400633a0fc0a87846c0a8783c0015930c14a79c94ddfd0cec801801fe723500000101080a0d7c552e89b671473232302057656c636f6d6520746f206d792046545020736572766963652e204e6f7420796f75727321204d792074726561737572652e2e2e2e0d0a


#0242c0a878500242c0a87846080045000069f959400040063b85ec0a87846c0a8783c0015d12241abd7fe3e8959f2801801fe722f00000101080a0d78905489b2ac7032323720456e746572696e672050617373697665204d6f646520283139322c3136382c3132302c37302c3131322c313136292e0d0a

#Send the packet:
#OLD - Because of too large messages
#resInt = libpcap.sendpacket(func_pcap_t, func_packetPointer, int(func_sizePacketDataInt))
#NEW - With inject function to try to avoid bug
resInt = libpcap.inject(func_pcap_t, func_packetPointer, int(func_sizePacketDataInt))

#Error checking for libpcap.inject function
if resInt != int(func_sizePacketDataInt):
	print("ERROR -  sending a packet with sendPacketPcapGlobal.")
	print("""ERROR - DEBUG - sendPacketPcapGlobal - str(''.join(pkt_data)).replace("0x","").replace(" ","") = """, str(''.join(pkt_data)).replace("0x","").replace(" ",""))
	print("ERROR - DEBUG - sendPacketPcapGlobal - func_sizePacketDataInt = ", func_sizePacketDataInt)
	print("ERROR - DEBUG - sendPacketPcapGlobal - resInt = ", resInt)
	
	if resInt ==  libpcap.PCAP_ERROR_NOT_ACTIVATED:
		print("ERROR - pcap_t not activated")
		
	elif resInt == libpcap.PCAP_ERROR:
		#char *pcap_geterr(pcap_t *p);
		errorBuff = libpcap.geterr(func_pcap_t)
		print("ERROR - Error Description: ", errorBuff)
	else:
		print("ERROR - UNKNOWN - resInt = ", resInt)

else:
	#print("SUCCESS!!! - Packet send using the function sendPacketPcapGlobal !!!")
	pass

"""
#OLD - Because of too large messages
#resInt = libpcap.sendpacket(func_pcap_t, func_packetPointer, int(func_sizePacketDataInt))
#Error checking for sendpacket function
if resInt != 0:
	print("ERROR -  sending a packet with sendPacketPcapGlobal.")
	print("ERROR - DEBUG - sendPacketPcapGlobal - str(''.join(pkt_data)).replace("0x","").replace(" ","") = ", str(''.join(pkt_data)).replace("0x","").replace(" ",""))
	print("ERROR - DEBUG - sendPacketPcapGlobal - func_sizePacketDataInt = ", func_sizePacketDataInt)
	
	if resInt ==  libpcap.PCAP_ERROR_NOT_ACTIVATED:
		print("ERROR - pcap_t not activated")
		
	elif resInt == libpcap.PCAP_ERROR:
		#char *pcap_geterr(pcap_t *p);
		errorBuff = libpcap.geterr(func_pcap_t)
		print("ERROR - Error Description: ", errorBuff)
	else:
		print("ERROR - UNKNOWN")

"""
return 0

`
"CODE END"

EDIT: I forgot some possibly important info about the system:

/home # pip list
Package Version
appdirs 1.4.4
contextlib2 21.6.0
importlib-metadata 6.8.0
importlib-resources 6.1.0
libpcap 1.11.0b7
more-itertools 8.13.0
numpy 1.26.1
ordered-set 4.0.2
packaging 21.3
pep517 0.12.0
pip 22.1.1
pkg-about 1.0.8
pyparsing 2.4.7
retrying 1.3.3
setuptools 68.2.2
six 1.16.0
tomli 2.0.1
zipp 3.17.0
/home # pip install libpcap
Requirement already satisfied: libpcap in /usr/lib/python3.10/site-packages (1.11.0b7)
Requirement already satisfied: setuptools>=63.2.0 in /usr/lib/python3.10/site-packages (from libpcap) (68.2.2)
Requirement already satisfied: pkg-about>=1.0.7 in /usr/lib/python3.10/site-packages (from libpcap) (1.0.8)
Requirement already satisfied: importlib-resources>=5.7.1 in /usr/lib/python3.10/site-packages (from pkg-about>=1.0.7->libpcap) (6.1.0)
Requirement already satisfied: packaging>=21.3.0 in /usr/lib/python3.10/site-packages (from pkg-about>=1.0.7->libpcap) (21.3)
Requirement already satisfied: tomli>=2.0.1 in /usr/lib/python3.10/site-packages (from pkg-about>=1.0.7->libpcap) (2.0.1)
Requirement already satisfied: importlib-metadata>=4.12.0 in /usr/lib/python3.10/site-packages (from pkg-about>=1.0.7->libpcap) (6.8.0)
Requirement already satisfied: zipp>=0.5 in /usr/lib/python3.10/site-packages (from importlib-metadata>=4.12.0->pkg-about>=1.0.7->libpcap) (3.17.0)

I was wondering how to avoid both problems, or if it was a bug of the library libpcap in C or in Python. Any help would be really welcome. Thank you for your time.

NameError: name 'time_t' is not defined

A simple import libpcap already gives a NameError exception.

$ python
Python 2.7.15rc1 (default, Nov 12 2018, 14:31:15) 
[GCC 7.3.0] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import libpcap
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/tmp/testpcap/.env/local/lib/python2.7/site-packages/libpcap/__init__.py", line 7, in <module>
    from ._pcap import *
  File "/tmp/testpcap/.env/local/lib/python2.7/site-packages/libpcap/_pcap.py", line 74, in <module>
    from ._platform import is_windows, is_linux, defined
  File "/tmp/testpcap/.env/local/lib/python2.7/site-packages/libpcap/_platform/__init__.py", line 32, in <module>
    from ._linux   import DLL_PATH, DLL, CFUNC, dlclose
  File "/tmp/testpcap/.env/local/lib/python2.7/site-packages/libpcap/_platform/_linux/__init__.py", line 38, in <module>
    class timeval(ct.Structure):
  File "/tmp/testpcap/.env/local/lib/python2.7/site-packages/libpcap/_platform/_linux/__init__.py", line 40, in timeval
    ("tv_sec",  time_t),       # seconds
NameError: name 'time_t' is not defined

Integration with pytest?

Hello, I have a question:

developing psycopg, I might be interested in verifying that certain operation result in certain traffic being sent/received between the client and the server. See psycopg/psycopg#145 for instance.

• Would libpcap be useful for this tool, i.e. knowledgeable about the Postgres wire protocol? I know that wireshark is but I don't know the full stack and where such knowledge reside.
• Would it be possible to integrate something in order to start, record, stop from Python and to obtain objects to manipulate in Python with the result of the capture?
• what I would do of the above is probably a plugin to integrate with pytest. Wouldn't it be rad?

Thank you very much, and apologies if the question is kinda stupid: I don't know much about these libraries and how they compose.

Support Macos

I run this on Macos 10.14 with iPython and get this error:

In [3]: import libpcap
---------------------------------------------------------------------------
NotImplementedError                       Traceback (most recent call last)
<ipython-input-3-0c40fb8a6e56> in <module>
----> 1 import libpcap

/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/libpcap/__init__.py in <module>
      5 from . import __config__ ; del __config__
      6 from .__about__ import * ; del __about__
----> 7 from ._pcap import *

/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/libpcap/_pcap.py in <module>
     70             else ct.c_int64)
     71
---> 72 from ._platform import is_windows, is_linux, defined
     73 from ._platform import CFUNC
     74 from ._platform import SOCKET, INVALID_SOCKET, timeval, sockaddr

/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/libpcap/_platform/__init__.py in <module>
     33     from ._linux   import sockaddr, in_addr, sockaddr_in, in6_addr, sockaddr_in6
     34 elif is_osx:
---> 35     from ._osx     import DLL_PATH, DLL, dlclose, CFUNC
     36     from ._osx     import timeval, SOCKET, INVALID_SOCKET
     37     from ._osx     import sockaddr, in_addr, sockaddr_in, in6_addr, sockaddr_in6

/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/libpcap/_platform/_osx/__init__.py in <module>
     14 arch_dir = os.path.join(this_dir, arch)
     15
---> 16 raise NotImplementedError("This OS is not supported yet!")
     17
     18 try:

NotImplementedError: This OS is not supported yet!

I can provide additional info as necessary.