Beefy Boxes and Bandwidth Generously Provided by pair Networks
The stupid question is the question not asked
 
PerlMonks  

comment on

( [id://3333]=superdoc: print w/replies, xml ) Need Help??
This works, assuming you redirect your tcpdump output to a file. Run with your output file as STDIN to this snippet. You could probably use IO::File here as well:
use strict; open (DUMP, "|cat -v"); select(DUMP); $| = 1; while (<>) { if (/^\s/) { chop; s/\s//g; while ($_) { my $hex; ($hex, $_) = /^(..)(.*)$/; my $byte = hex($hex); print pack("c", $byte); } } else { print "\n", "-"x74, "\n\n"; } } close(DUMP);

Here's another, which runs tcpdump directly:

use strict; my ($pkt, $client, $host); my $lim = shift || 999999999; my $tcpd = "/usr/sbin/tcpdump"; my $tcpargs = "-lnx -s 1024 dst host 68.14.142.134|"; $|=1; open (STDIN, "$tcpd $tcpargs"); while (<>) { if (/^\S/) { last unless $lim--; while ($pkt=~/(.+).+/g) { print "$client -> $host\t$&\n"; } ($client, $host, $pkt) = (); # All on one line please ($client, $host) = /(\d+\.\d+\.\d+\.\d+).+ > (\d+\.\d+\.\d+\.\d+)/ if /P \d+:\d+\((\d+)\)/ && $1 > 0; } next unless $client && $host; s/\s+//; s/([0-9a-f]{2})\s?/chr(hex($1))/eg; tr/\x1F-\x7E\r\n//cd; $pkt .= $_; }

Here's one using Net::Pcap and Net::RawIP. I leave the decoding of the packet stream up to you..

use strict; use Net::Pcap; use Net::RawIP; my $errstr; my $count = 0; my $dev = Net::Pcap::lookupdev(\$errstr); my $pcap = Net::Pcap::open_live($dev, 1024, 1, 0, \$errstr); Net::Pcap::loop($pcap, -1, \&check_tcp, "abc"); Net::Pcap::close($pcap); sub check_tcp { my ($user, $hdr, $pkt) = @_; # Add your error checking here print "Saw snap of len hdr->{len} $hdr->{caplen} \n"; $count++; }

In reply to Re: converting tcpdump files by hacker
in thread converting tcpdump files by botho

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post; it's "PerlMonks-approved HTML":



  • Are you posting in the right place? Check out Where do I post X? to know for sure.
  • Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
    <code> <a> <b> <big> <blockquote> <br /> <dd> <dl> <dt> <em> <font> <h1> <h2> <h3> <h4> <h5> <h6> <hr /> <i> <li> <nbsp> <ol> <p> <small> <strike> <strong> <sub> <sup> <table> <td> <th> <tr> <tt> <u> <ul>
  • Snippets of code should be wrapped in <code> tags not <pre> tags. In fact, <pre> tags should generally be avoided. If they must be used, extreme care should be taken to ensure that their contents do not have long lines (<70 chars), in order to prevent horizontal scrolling (and possible janitor intervention).
  • Want more info? How to link or How to display code and escape characters are good places to start.
Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others drinking their drinks and smoking their pipes about the Monastery: (5)
As of 2024-04-19 22:36 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found