I'm trying to capture network packages that are send to my machine and from my machine.
I use winPcap, along with Net::PcapUtils, NetPacket::Ethernet, NetPacket::IP, NetPacket::TCP. (Recently updated all these packages).
All seems to work fine, but I'm not receiving any SYN packages.
Has anyone any idea what I'm doing wrong?

I'm using Windows XP SP2 and perl 5.8.
The code I use is as follows:
@devices = Net::Pcap::findalldevs(\%devinfo, \$err); $log->infoDebug("All the devices listed are:"); for my $dev (@devices) { $log->infoDebug("$dev : $devinfo{$dev}"); if($devinfo{$dev} =~ /Broadcom NetXtreme Gigabit/i) { $log->infoLow("The found DUT network device is $dev : $devinfo{$ +dev}"); $device = $dev; $deviceInfo = $devinfo{$dev}; } } if($device eq "") { $stepOk = 0; $errorMsg = "Unable to find the DUTs network key. Maybe the DUT is + not powered yet."; $log->infoError($errorMsg); } if($stepOk) { if (Net::Pcap::lookupnet($device, \$address, \$netmask, \$err)) { $stepOk = 0; $errorMsg = "Unable to look up device information for ".$device. +' - '.$err; $log->infoError($errorMsg); } } if($stepOk) { $netObj = Net::Pcap::open_live($device, 1500, 0, $timeout, \$err); unless (defined $netObj) { $stepOk = 0; $errorMsg = "Unable to create packet capture on device ".$device +.' - '.$err; $log->infoError($errorMsg); } } if($stepOk) { $networkDevice = Net::PcapUtils::open(PROMISC => 0); if(! ref($networkDevice)) { $stepOk = 0; $errorMsg = "Unable to open the network Device: $networkDevice"; $log->infoError($errorMsg); } my $amount = 50; my $packet = ""; my %header = (); my $ctu = 1; for(my $tel = 0; ($tel < $amount) and $ctu; $tel++) { ($packet,%header) = Net::PcapUtils::next($netObj); $log->infoHigh("The return result of the next function is: $pack +et"); $log->infoHigh("And:"); my @key = keys %header; for(my $tel = 0; $tel < @key; $tel++) { $log->infoHigh("The key ".$key[$tel]." has as value: ".$header +{$key[$tel]}); } my $helpDec = ""; my $helpBin = ""; my $ip = ""; my $tcp = ""; my $ether_data = NetPacket::Ethernet::strip($packet); my $ether_data2 = NetPacket::Ethernet->decode($packet); $log->info("ETHNL: ".$ether_data2->{type}); $log->info("ETHMACSD: ".$ether_data2->{src_mac}." -> ".$ether_da +ta2->{dest_mac}); if($ether_data2->{type} == NetPacket::Ethernet::ETH_TYPE_IP) # 2 +048: 0x0800: IPv4 { $ip = NetPacket::IP->decode($ether_data); $tcp = NetPacket::TCP->decode($ip->{'data'}); $log->info("IPADRSD: ".$ip->{'src_ip'}.":".$tcp->{'src_port'}. +" -> ".$ip->{'dest_ip'}.":".$tcp->{'dest_port'}); $helpDec = sprintf("%d", $ip->{'tos'}); $helpBin = unpack("B*", pack('C',$helpDec)); $log->info("IPPRE: ".substr($helpBin,7,3)); # type of service: + precedence. $log->info("IPD: ".substr($helpBin,4,1)); #IP type of service +D $log->info("IPT: ".substr($helpBin,3,1)); #IP type of service +T $log->info("IPR: ".substr($helpBin,2,1)); #IP type of service +R $log->info("IPECT: ".substr($helpBin,1,1)); #IP type of servic +e ECN-capable transport (ECT) $log->info("IPECNCE: ".substr($helpBin,0,1)); # IP type of ser +vice ECN-CE $log->info("IPDALE: ".$ip->{'len'}); #total length of the IP d +atagram $log->info("IPID: ".$ip->{'id'}); #IP packet ID $log->info("IPFO: ".$ip->{'foffset'}); #IP fragment offset $log->info("IPTTL: ".$ip->{'ttl'}); #IP Time To Live $log->info("IPPRO: ".$ip->{'proto'}); #IP protocol $log->info("IPOPT: ".$ip->{'options'}); #IP options $log->info("IPVER: ".$ip->{'ver'}); #IP version $helpDec = sprintf("%d", $ip->{'flags'}); $helpBin = unpack("B*", pack('C',$helpDec)); $log->info("IPMF: ".substr($helpBin,7,1)); #IP flag More Fragm +ents (MF) $log->info("IPDF: ".substr($helpBin,6,1)); #IP flag Dont Fragm +ent (DF) $log->info("TCPWS: ".$tcp->{'winsize'}); #TCP window size $log->info("TCPACKNO: ".$tcp->{'acknum'}); #TCP Acknowledge nu +mber $log->info("TCPSEQNO: ".$tcp->{'seqnum'}); #TCP sequence numbe +r $log->info("TCPUP: ".$tcp->{'urg'}); #TCP urgent pointer $log->info("TCPOPT: "."0b".$tcp->{'options'}); #TCP options $helpDec = sprintf("%d", $ip->{'flags'}); $helpBin = unpack("B*", pack('C',$helpDec)); $log->info("TCPFLAG: ".$helpBin); #TCP binary flag $log->info("Or: ".$helpDec); #TCP binary flag $log->info("or: ".$ip->{'flags'}); #TCP binary flag $log->info("TCPACK: ".substr($helpBin,6,1)); #TCP flag ACK $log->info("TCPPSH: ".substr($helpBin,5,1)); #TCP flag PUSH (P +SH) $log->info("TCPRST: ".substr($helpBin,4,1)); #TCP flag RESET ( +RST) $log->info("TCPSYN: ".substr($helpBin,3,1)); #TCP flag SYN $log->info("TCPFIN: ".substr($helpBin,2,1)); #TCP flag FIN if(substr($helpBin,3,1) == 1) { $ctu = 0; } } }

The $log->info(); $log->infoHigh() and $log->infoError() are a fancy way of logging the data generated to file.

20060621 Janitored by Corion: Added <readmore> tag


In reply to Win32 TCP SYN messages by jschollen

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":



  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.