Anonymous Monk has asked for the wisdom of the Perl Monks concerning the following question:

Folks I am new here, and to Perl; however, I have started reading the O'reilly Learn Perl book.

Yet, I have a few questions, and require someone to point me in the right direction. I do not have a stream background in coding, or related resoruces; however, logically I can think of what I want to accomplish

I need to have the ability to montior a multicast stream from an IP address, and if a drop in multicast packets is detected, then generate an email.

Currently I am just watching tcpdump captures of a block of IP addresses, but I want to automate the process.

I am thinking that tcpdump and sendmail can be used or leveraged for this; however, I am not sure how or what steps I need to take to move forward.

I don't even have code yet, but any assitance on direction or ideas... are welcomed.

Thank you... JJ

  • Comment on Point me in the right direction - Monitor a Mulicast IP address or stream

Replies are listed 'Best First'.
Re: Point me in the right direction - Monitor a Mulicast IP address or stream
by VinsWorldcom (Prior) on Aug 20, 2013 at 14:45 UTC

    Perl can listen on multicast streams easily with IO::Socket::Multicast. There is even an IPv6 version at IO::Socket::Multicast6.

    Here is a simple multicast listener example (IPv4-only):

    #!/usr/bin/perl

use strict;
use warnings;
use IO::Socket::Multicast;

my $sock = IO::Socket::Multicast->new(
    LocalPort => 7070,
    ReuseAddr => 1
) or die "Cannot create client\n";;

$sock->mcast_add("239.192.1.1") || die "Cannot set group: $!\n";

my $data;
while (1) {
    $sock->recv($data,1024);
    my $peer_addr = $sock->peerhost();
    my $peer_port = $sock->peerport();
    print "($peer_addr:$peer_port): $data\n"
}

    [download]

    You can use a select() timer instead of the while loop and if you reach a timeout - send the email.

[reply]
[d/l]
[reply]
      Thanks everyone for the quick and detailed replies. I will continue to discover and understand these findings.
[reply]
Re: Point me in the right direction - Monitor a Mulicast IP address or stream
by PerlSufi (Friar) on Aug 20, 2013 at 14:48 UTC
    Hi there,
    From one new person to another, the first suggestion I would have is that whenever you wonder 'can I do X..?' -always go to search.cpan.org first and search for modules there with good keywords. I have not done all of what you are asking to do with Perl, but I have monitored packets with nmap. Anyways, I have emailed from Perl on many occasions quite successfully with MIME::Entity and MIME::Lite. I personally prefer to use the former. Both of those module's documentation can be found on CPAN. Searching 'IP packets' at CPAN yielded the module NetPacket::IP as the first result. So that may be a good place to start.
    If you are using Active State Perl, I suggest running 'ppm install <module-name-here>' on any of those to get you started.
[reply]
      PerlSufi: your reply about NetPacket would certainly help in the direction of implementing the 'tcpdump' approach the OP mentioned. May I also suggest the Net::Frame suite as I believe it is more complete based on number of CPAN results returned. That and I also have a bias as I use it (very easy) and have written a few extensions (IPv6 and extension headers, DNS, RIP/ng, etc...) for it.

      Ultimately, I think the IO::Socket::Multicast route with your recommendation of a MIME package for emailing is the best way to go. But then again, TMTOWTDI!

[reply]
        VinsWorldcom: looking at the documentation, IO::Socket::Multicast looks great, indeed. :)
[reply]
      Thank you for suggesting "Active State Perl". At this point I might use this, since I was a little lost at configuring CPAN on a company server. The latter is due to a number off errors being generated during the install of a package from CPAN, yet I did not fully understand the errors, which I suspect is due to being new with Perl and CPAN. Yet, I am very eger to learn Perl. However, I will still need to learn CPAN, since the very end product will need to be installed on a CentOS6.3 box that is located at a very remote site. thanks again JJ
[reply]
        Yeah some module's dependencies are difficult to resolve.. usually you will get CPAN errors for things like that. Happy Perl-ing :)
[reply]

Back to Seekers of Perl Wisdom