Python and NGREP

Question

I want to be able to start and stop an NGREP process from inside my python code. I really dont have experience with python on a system level.

Normally I run NGREP from the command line, but I would like to be able to run it from a script every hour and capture the trace and then process the results.

Can anyone point me in the direction of how to achieve this.

By the way, I really just need to be able to do a packet capture, perhaps Python has builtin capabilities for this, maybe tcpdump?

Thanks.

Answer 1

Look up threading.Timer and pexpect. If you don't want to install pexpect, you can use subprocess.Popen instead.

EDIT: In response to the comment:

import os
from signal import SIGTERM, SIGKILL
os.kill(pid, SIGTERM) #you can also send SIGKILL instead of SIGTERM. 
#You might also have to put this call in a try block and catch OSError
#Only available on *NIX

EDIT2: If you want to hand-roll the packet capture, use pypcap. This should almost certainly do what you want, since tcpdump uses libpcap itself.

Answer 2

its not in-built, but you can try Packet Capture and Injection Library