Here is a snippet of some 10-year old code I wrote, that uses Net::Pcap and NetPacket::Ethernet :

use strict;
use English;
use Net::Pcap;
use NetPacket::Ethernet qw(:types);
...
use Data::HexDump;

my %pcap_parameters = (
        SNAPLEN => 124,         # Num bytes to capture from packet
    PROMISCUOUS_MODE => 1,  # Operate in promiscuous mode?
        TIMEOUT => 1000,        # Read timeout (ms)
        NUMPACKETS => 500,       # Pkts to read (-1 = loop forever)
        #FILTER => 'ip proto \icmp',           # Filter string
        FILTER => 'arp or udp dst port 161',           # Filter string
    USERDATA => '',         # Passed as first arg to callback fn
    SAVEFILE => '',         # Default save file

        # Items below are RETURNED values from PCap calls.
        # Do not attempt to change them in the declaration.
        FILTER_HANDLE => 0,     # Reference to compiled filter
        NETWORK_INTERFACE => 'intel',# Network interface to open
        NETWORK_ADDR =>0,       # Network Address (32 bit number)
        NETWORK_MASK =>0,       # Mask (32-bit number)
    mode => '',             # Internal variable
        );

# Partial list from http://www.iana.org/assignments/ethernet-numbers
my %Ethernet_Type_Name = (
           (ETH_TYPE_IP)        =>{NAME=>'IP', DECODER => \&Decode_IP}
+,
           (ETH_TYPE_ARP)       =>{NAME=>'ARP', DECODER => \&Decode_AR
+P},
           (ETH_TYPE_APPLETALK) =>{NAME=>'APPLETALK', DECODER => 0},
...

  $pcap_desc = Net::Pcap::open_live($pcap_parameters{NETWORK_INTERFACE
+}, $pcap_parameters{SNAPLEN},
                        $pcap_parameters{PROMISCUOUS_MODE},
                        $pcap_parameters{TIMEOUT},
                        \$err)
         or  die("Net::Pcap::open_live returned error $err\n");
...
my $count = 0;

Net::Pcap::loop($pcap_desc, $pcap_parameters{NUMPACKETS}, \&process_pk
+t, "abc");
...
sub process_pkt {
    my($user, $hdr, $pkt) = @_;
.....
    my ($sec,$min,$hour) =localtime($hdr->{tv_sec});
    my $len= $hdr->{len};
    my $buf;
    #print("RcvPkt Totlen(PacketLen) $hdr->{len}($hdr->{caplen})" .
    #  "\t Time.Usec=$hour:$min:$sec.$hdr->{tv_usec}\n");

    my $eth_obj = NetPacket::Ethernet->decode($pkt);
    #print("$eth_obj->{src_mac}:$eth_obj->{dest_mac} " .
    #      "$Ethernet_Type_Name{$eth_obj->{type}} \n");
    $buf = sprintf("%02d:%02d:%02d.%03d[%4d] ",
           $hour,$min,$sec, $hdr->{tv_usec} / 1000,$hdr->{len});
    # Call the appropriate decoder, depending on pkt type
    if (&Dispach_Decoder_If_Any(\%Ethernet_Type_Name, $eth_obj->{type}
+,
                                 $eth_obj,\$buf)){
        # Decoder call failed..
        $buf .= "Ether " .
           $eth_obj->{src_mac} . "-> $eth_obj->{dest_mac} " .
           &get_TypeName(\%Ethernet_Type_Name,$eth_obj->{type}) ;
...
}
[download]

I'm happy to share the entire code ( < 500 lines) - /msg me with your email address.

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.