Beefy Boxes and Bandwidth Generously Provided by pair Networks
No such thing as a small change

Re: Packet parsing with Net::Frame::Layer::ETH

by NetWallah (Abbot)
on Jan 14, 2013 at 03:31 UTC ( #1013151=note: print w/replies, xml ) Need Help??

in reply to Packet parsing with Net::Frame::Layer::ETH

Here is a snippet of some 10-year old code I wrote, that uses Net::Pcap and NetPacket::Ethernet :
use strict; use English; use Net::Pcap; use NetPacket::Ethernet qw(:types); ... use Data::HexDump; my %pcap_parameters = ( SNAPLEN => 124, # Num bytes to capture from packet PROMISCUOUS_MODE => 1, # Operate in promiscuous mode? TIMEOUT => 1000, # Read timeout (ms) NUMPACKETS => 500, # Pkts to read (-1 = loop forever) #FILTER => 'ip proto \icmp', # Filter string FILTER => 'arp or udp dst port 161', # Filter string USERDATA => '', # Passed as first arg to callback fn SAVEFILE => '', # Default save file # Items below are RETURNED values from PCap calls. # Do not attempt to change them in the declaration. FILTER_HANDLE => 0, # Reference to compiled filter NETWORK_INTERFACE => 'intel',# Network interface to open NETWORK_ADDR =>0, # Network Address (32 bit number) NETWORK_MASK =>0, # Mask (32-bit number) mode => '', # Internal variable ); # Partial list from my %Ethernet_Type_Name = ( (ETH_TYPE_IP) =>{NAME=>'IP', DECODER => \&Decode_IP} +, (ETH_TYPE_ARP) =>{NAME=>'ARP', DECODER => \&Decode_AR +P}, (ETH_TYPE_APPLETALK) =>{NAME=>'APPLETALK', DECODER => 0}, ... $pcap_desc = Net::Pcap::open_live($pcap_parameters{NETWORK_INTERFACE +}, $pcap_parameters{SNAPLEN}, $pcap_parameters{PROMISCUOUS_MODE}, $pcap_parameters{TIMEOUT}, \$err) or die("Net::Pcap::open_live returned error $err\n"); ... my $count = 0; Net::Pcap::loop($pcap_desc, $pcap_parameters{NUMPACKETS}, \&process_pk +t, "abc"); ... sub process_pkt { my($user, $hdr, $pkt) = @_; ..... my ($sec,$min,$hour) =localtime($hdr->{tv_sec}); my $len= $hdr->{len}; my $buf; #print("RcvPkt Totlen(PacketLen) $hdr->{len}($hdr->{caplen})" . # "\t Time.Usec=$hour:$min:$sec.$hdr->{tv_usec}\n"); my $eth_obj = NetPacket::Ethernet->decode($pkt); #print("$eth_obj->{src_mac}:$eth_obj->{dest_mac} " . # "$Ethernet_Type_Name{$eth_obj->{type}} \n"); $buf = sprintf("%02d:%02d:%02d.%03d[%4d] ", $hour,$min,$sec, $hdr->{tv_usec} / 1000,$hdr->{len}); # Call the appropriate decoder, depending on pkt type if (&Dispach_Decoder_If_Any(\%Ethernet_Type_Name, $eth_obj->{type} +, $eth_obj,\$buf)){ # Decoder call failed.. $buf .= "Ether " . $eth_obj->{src_mac} . "-> $eth_obj->{dest_mac} " . &get_TypeName(\%Ethernet_Type_Name,$eth_obj->{type}) ; ... }
I'm happy to share the entire code ( < 500 lines) - /msg me with your email address.

             Most people believe that if it ain't broke, don't fix it.
        Engineers believe that if it ain't broke, it doesn't have enough features yet.

Replies are listed 'Best First'.
Re^2: Packet parsing with Net::Frame::Layer::ETH
by highland7 (Novice) on Jan 14, 2013 at 06:52 UTC
    Thanks, used NetPacket::Ethernet from your example and with this library everything is fine :)

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://1013151]
[ambrus]: Corion: as for that, I talked with schmorp, and looked a bit more at Prima
[ambrus]: Corion: from the docs, it definitely looks like it would be possible to write an AnyEvent driver for it using Prima::File and Prima::Timer.
[ambrus]: (I haven't found an idle event.)
[ambrus]: However, I also looked at the internals, and found two interesting things:
[marto]: stupid xpath question, I have a xpath copied from the browser, is the * wildcard supposed to work for IDs? e.g. '//*[@id="*"]/ div/div/header/p/a '?
[ambrus]: The main loop for unixish systems is in https://metacpan. org/source/ KARASIK/Prima-1. 49/unix/apc_app.c. It is a hand-rolled select loop, but also always spins at least once every 0.2 seconds for some reason.

How do I use this? | Other CB clients
Other Users?
Others about the Monastery: (8)
As of 2016-12-08 10:48 GMT
Find Nodes?
    Voting Booth?
    On a regular basis, I'm most likely to spy upon:

    Results (140 votes). Check out past polls.