raj_paps has asked for the wisdom of the Perl Monks concerning the following question:

Hi, I'm trying to retrieve i/p address with off-line packets. I am able to do by reading each byte 
    my $src_addr   = substr($pkt, 26, 1);
    my $src_addr1  = ord  $src_addr;

    $src_addr      = substr($pkt, 27, 1);
    my $src_addr2  = ord $src_addr;

    $src_addr      = substr($pkt, 28, 1);
    my $src_addr3  = ord $src_addr;

    $src_addr      = substr($pkt, 29, 1);
    my $src_addr4  = ord $src_addr;

[download]
This is not efficient. I am sure there must be elegant way to do this. some examples please..?

Replies are listed 'Best First'.
Re: Net::Pcap print ip address
by shmem (Chancellor) on May 29, 2013 at 11:23 UTC
    This is not efficient. I am sure there must be elegant way to do this. some examples please..?

    You could use unpack and join. 

    my $addr = join '.', unpack 'x25 C4', $pkt;

    [download]
[reply]
[d/l]
Re: Net::Pcap print ip address
by VinsWorldcom (Prior) on May 29, 2013 at 11:37 UTC

    What you really need is a "dissector" - packet capture speak for a framework / library that can take a raw packet and parse / separate the constituent headers and name/value pairs.

    Have a look at Net::Frame and Net::Frame::Simple (you'll need both) which comes with some examples and makes this task trivial.

[reply]
Re: Net::Pcap print ip address
by t_rex_joe (Sexton) on May 29, 2013 at 13:58 UTC
    You are mentioning using a offline pcap? I use the "Net::PcapUtils" Module. You can lookup the cpan module: http://search.cpan.org/~timpotter/Net-PcapUtils-0.01/PcapUtils.pm. I use this module to seek DHCP packets. Parsing our data inside of the packet then output into a file. Here's a snippet that maybe a guide. 
    use Net::Pcap;
use FileHandle;
use Net::PcapUtils;
use Data::HexDump;
use NetPacket::IP qw(:ALL);
use NetPacket::TCP qw(:ALL);
use NetPacket::UDP qw(:ALL);
use NetPacket::Ethernet qw(:ALL);
use DBI;
use Net::DHCP::Packet;

Net::PcapUtils::loop(\&process, DEV => 'p3p1', FILTER => 'port 67', SN
+APLEN => 1500, PROMISC => 0);



sub process
  {

 my($ip, $eth, $udp, $len, $tcp);
  my $debug = 0;

  if($debug == 1) { print "ENTERED SUB PROCESS\n"; }
  my $v1 = undef;
  my $v2 = undef;
  my $pkt = undef;
  my $key = undef;
  my $val = undef;

  ($v1, $v2, $pkt) = @_;


  if($debug == 1) { print "V1: \"$v1\"\n"; }
  if($debug == 1) { print "V2: \"$v2\"\n"; }
  if($debug == 1) { print "PKT: \"$pkt\"\n"; }

  $eth = NetPacket::Ethernet->decode($pkt);

  if($eth->{type} != 2048)  #1500 Ethernet_II, 2048 IP, 
     { print "UNK ETH FRAME TYPE \"" . $eth->{type} . "\"\n"; return; 
+} 

  $ip = NetPacket::IP->decode($eth->{data});
  #foreach $key (keys %$ip) { print "$key\n"; }
  

  my $src_ip = $ip->{src_ip};

  if($ip->{proto} != 17) #6 = tcp, 17 = udp
    { print "NON UDP FRAME.. NEXT\n"; return; }

  $udp=NetPacket::UDP->decode($ip->{data});

  my $packet = Net::DHCP::Packet->new($udp->{data});

  my $output = $packet->toString();
  if($debug == 1) { print "OUTPUT: \"$output\" L:\"" . __LINE__ . "\"\
+n"; }

  }

    [download]
    Please keep in mind this script will not work as is. You will need to add a few things (#!)..
[reply]
[d/l]

Back to Seekers of Perl Wisdom