Delete pcap file after parsing it with PcapReader in scapy - python-2.7

Question

I'm parsing a pcap file with PcapReader in scapy. After that I want to delete the pcap file. But it sucks because of this error:
OSError: [Errno 26] Text file busy: '/media/sf_SharedFolder/AVB/test.pcap'
This is my python code:
from scapy.all import *
import os
var = []
for packet in PcapReader('/media/sf_SharedFolder/AVB/test.pcap'):
var.append(packet[Ether].src)
os.remove('/media/sf_SharedFolder/AVB/test.pcap')
I think that this error occurs with any pcap file.
Does somebody has any idea?

Answer 1

You may want to try with Scapy's latest development version (from https://github.com/secdev/scapy), since I cannot reproduce your issue with it.
If that does not work, check with lsof /media/sf_SharedFolder/AVB/test.pcap (as root) if another program has opened your capture file. If so, try to find (and kill, if possible) that program.
You can try two different hacks, to try to figure out what exactly is happening:
Test 1: wait.
from scapy.all import *
import os
import time
var = []
for packet in PcapReader('/media/sf_SharedFolder/AVB/test.pcap'):
var.append(packet[Ether].src)
time.sleep(2)
os.remove('/media/sf_SharedFolder/AVB/test.pcap')
Test 2: explicitly close.
from scapy.all import *
import os
var = []
pktgen = PcapReader('/media/sf_SharedFolder/AVB/test.pcap')
for packet in pktgen:
var.append(packet[Ether].src)
pktgen.close()
os.remove('/media/sf_SharedFolder/AVB/test.pcap')

Answer 2

Found the solution. I replaced "PcapReader()" through "rdpcap()". Seems like PcapReader is open until the python script is finished.
This is the working code:
from scapy.all import *
import os
var = []
p=rdpcap('/media/sf_SharedFolder/AVB/test.pcap')
for packet in p:
var.append(packet[Ether].src)
os.remove('/media/sf_SharedFolder/AVB/test.pcap')