Problems with reading pcap with rdpcap

[static33rus]

Hi,
i am rewriting autotests from python2.7 to python3+ and have a problem with reading pcap files.

scenario:

1. I write pcap in file using tcpdump and stop tcpdump
2. I read that pcap by rdpcap (in that step all fine)
3. I write new pcap (with same name and overwrite previous pcap) and stop tcpdump
4. I try to read new pcap by rdpcap. In that time CPU and memory loading increases to 100%, but there are no errors, program is still working. It seems like it’s in an endless loop.
   In this step (in parallel with autotests) i tried to open same pcap manually from python interpreter (same Virtual machine, same python version, same path and pcap file) and read pcap without any problem. But in autotests it reproduces in 100% cases. With python 2.7 and old version scapy same code works stable. What i did wrong? Can you help me?

i've got trace using pdb:

(Pdb) !path
'/tmp/104/test_clear_bgp_data_about_neighbors/br1547080.pcap'
(Pdb) next
> /home/nfware/autotest/automated_tests/aw.py(165)download_and_read_pcap_file()
-> return rdpcap(path)
(Pdb) step
--Call--
> /home/nfware/.local/lib/python3.6/site-packages/scapy/utils.py(829)rdpcap()
-> @conf.commands.register
(Pdb) next
> /home/nfware/.local/lib/python3.6/site-packages/scapy/utils.py(836)rdpcap()
-> with PcapReader(filename) as fdesc:
(Pdb) next
> /home/nfware/.local/lib/python3.6/site-packages/scapy/utils.py(837)rdpcap()
-> return fdesc.read_all(count=count)
(Pdb) next
at this step CPU loading increases to 100%

more detailed trace and pcap in attachment.
scapy (2.4.3rc1)
python 3.6.7

Thanks for help
pcap_and_trace.zip

[gpotter2]

Not sure what the issue is, but it’s very likely not a Scapy issue. I can’t reproduce with the pcap you’ve provided: works fine from the shell & code.

With python 2.7 and old version scapy same code works stable.

What does that mean ? Are you not having the issue on Python 2.7 ? Please recheck the version of Scapy you are using. Note that it can be different between Python 2 & 3, as they have different installation paths.

Checkout python3 -c "import scapy; print(scapy.__version__)" and python -c "import scapy; print(scapy.__version__)"

How is the pcap read ? Could you share a snippet ? Is it using filters ?

[guedou]

Please reopen if you can help us reproduce the issue.