CGI/Perl Guide | Learning Center | Forums | Advertise | Login
Site Search: in

  Main Index MAIN
INDEX
Search Posts SEARCH
POSTS
Who's Online WHO'S
ONLINE
Log in LOG
IN

Home: Perl Programming Help: mod_perl:
Script ... PCAP file ...

 



ReginaResende
New User

Dec 5, 2009, 5:49 PM

Post #1 of 1 (5265 views)
Script ... PCAP file ... Can't Post

Hi,
I'm a Perl newbie and I have a job to do, but I can't do that! I'm almost crying! =(
Please, someone help me?

This is my problem:
I have a txt file like this
Config.txt

SourceIP = 10.1.1.1
SourceMAC = 00d0047203fc
IPProtocol = 7
--------------------------------------------
Then I have a PCAP file with information about packets from a network capture.
In the script I need to compare the field from txt with the header of all packets and, if some match, show that packet.

Now my scrip is something like this:
Script.pl

#!/usr/bin/perl -w

use strict;
use warnings;
use Net::PcapUtils;
use Net::Pcap;
use NetPacket::Ethernet qw(:strip);
use NetPacket::IP;
#use Config::Reader::Simple;

my $file = "CaptureData.txt";
open FILE, ">$file" or die "unable to open $file $!";

my %config;
open my $config, '<', 'Config.txt' or die $!;


while(<$config>)
{
chomp;
my ($key, $value) = split /\s*=\s*/, $_;
$config{$key} = $value;
print FILE "chave: $key -- valor: $value\n";
}


my $err ='';
my $i = 1;
my $pcap = Net::Pcap::open_offline("capture.pcap", \$err) or die "Can't open file...$err\n";
Net::Pcap::loop($pcap, -1, \&process_pkt, '');

Net::Pcap::close($pcap);

sub process_pkt
{
my ($user, $hdr, $pkt) = @_;
my $ip_obj = NetPacket::IP->decode(eth_strip($pkt));
my $eth_obj = NetPacket::Ethernet->decode($pkt);
print FILE "$i\n";
print FILE "SourceIP : $ip_obj->{src_ip}\n";
print FILE "SourceMAC : $eth_obj->{src_mac}\n";
print FILE "EthernetType : $eth_obj->{type}\n";
print FILE "IPProtocol : $ip_obj->{proto}\n";
print FILE "----------------------------\n";
$i++;
}

close FILE, ">$file" or die "unable to close $file $!";
-------------------------------------------------------------------------------

Please, I need help!!

Regards

 
 


Search for (options) Powered by Gossamer Forum v.1.2.0

Web Applications & Managed Hosting Powered by Gossamer Threads
Visit our Mailing List Archives