I’m trying to sniff ICMP packets on my network using Python, but I’ve noticed a limitation. When I use my script, I can only sniff packets that receive replies (e.g., echo-reply). However, for offline hosts that don’t exist (e.g., a ping to 192.168.15.201 in the same subnet), I cannot capture the ICMP echo requests.

I’m interested in sniffing ICMP echo requests sent to both existing and non-existing hosts. This is particularly useful during penetration testing, such as when detecting ping sweeps. My goal is to identify these ICMP echo requests even if the target host is offline.

Here’s an example of my output when sniffing an online host:

[12/22/24]x@VM:~/.../practice$ sudo ./sniff.py 
Ether / IP / ICMP 192.168.15.1 > 192.168.15.195 echo-reply 0 / Raw
Ether / IP / ICMP 192.168.15.195 > 192.168.15.1 echo-request 0 / Raw
Ether / IP / ICMP 192.168.15.1 > 192.168.15.195 echo-reply 0 / Raw
Ether / IP / ICMP 192.168.15.195 > 192.168.15.1 echo-request 0 / Raw
Ether / IP / ICMP 192.168.15.1 > 192.168.15.195 echo-reply 0 / Raw
Ether / IP / ICMP 192.168.15.195 > 192.168.15.1 echo-request 0 / Raw
Ether / IP / ICMP 192.168.15.1 > 192.168.15.195 echo-reply 0 / Raw
Ether / IP / ICMP 192.168.15.195 > 192.168.15.1 echo-request 0 / Raw
Ether / IP / ICMP 192.168.15.1 > 192.168.15.195 echo-reply 0 / Raw
Ether / IP / ICMP 192.168.15.195 > 192.168.15.1 echo-request 0 / Raw

However, when pinging an offline host (e.g., 192.168.15.201), I don’t see any packets.

Here is the code I’m using

#!/usr/bin/python3
from scapy.all import *

def print_pkt(pkt):
    print(pkt.summary())

# Corrected sniff call
pkts = sniff(iface='x', filter='icmp', prn=print_pkt)