@devices = Net::Pcap::findalldevs(\%devinfo, \$err); $log->infoDebug("All the devices listed are:"); for my $dev (@devices) { $log->infoDebug("$dev : $devinfo{$dev}"); if($devinfo{$dev} =~ /Broadcom NetXtreme Gigabit/i) { $log->infoLow("The found DUT network device is $dev : $devinfo{$ +dev}"); $device = $dev; $deviceInfo = $devinfo{$dev}; } } if($device eq "") { $stepOk = 0; $errorMsg = "Unable to find the DUTs network key. Maybe the DUT is + not powered yet."; $log->infoError($errorMsg); } if($stepOk) { if (Net::Pcap::lookupnet($device, \$address, \$netmask, \$err)) { $stepOk = 0; $errorMsg = "Unable to look up device information for ".$device. +' - '.$err; $log->infoError($errorMsg); } } if($stepOk) { $netObj = Net::Pcap::open_live($device, 1500, 0, $timeout, \$err); unless (defined $netObj) { $stepOk = 0; $errorMsg = "Unable to create packet capture on device ".$device +.' - '.$err; $log->infoError($errorMsg); } } if($stepOk) { $networkDevice = Net::PcapUtils::open(PROMISC => 0); if(! ref($networkDevice)) { $stepOk = 0; $errorMsg = "Unable to open the network Device: $networkDevice"; $log->infoError($errorMsg); } my $amount = 50; my $packet = ""; my %header = (); my $ctu = 1; for(my $tel = 0; ($tel < $amount) and $ctu; $tel++) { ($packet,%header) = Net::PcapUtils::next($netObj); $log->infoHigh("The return result of the next function is: $pack +et"); $log->infoHigh("And:"); my @key = keys %header; for(my $tel = 0; $tel < @key; $tel++) { $log->infoHigh("The key ".$key[$tel]." has as value: ".$header +{$key[$tel]}); } my $helpDec = ""; my $helpBin = ""; my $ip = ""; my $tcp = ""; my $ether_data = NetPacket::Ethernet::strip($packet); my $ether_data2 = NetPacket::Ethernet->decode($packet); $log->info("ETHNL: ".$ether_data2->{type}); $log->info("ETHMACSD: ".$ether_data2->{src_mac}." -> ".$ether_da +ta2->{dest_mac}); if($ether_data2->{type} == NetPacket::Ethernet::ETH_TYPE_IP) # 2 +048: 0x0800: IPv4 { $ip = NetPacket::IP->decode($ether_data); $tcp = NetPacket::TCP->decode($ip->{'data'}); $log->info("IPADRSD: ".$ip->{'src_ip'}.":".$tcp->{'src_port'}. +" -> ".$ip->{'dest_ip'}.":".$tcp->{'dest_port'}); $helpDec = sprintf("%d", $ip->{'tos'}); $helpBin = unpack("B*", pack('C',$helpDec)); $log->info("IPPRE: ".substr($helpBin,7,3)); # type of service: + precedence. $log->info("IPD: ".substr($helpBin,4,1)); #IP type of service +D $log->info("IPT: ".substr($helpBin,3,1)); #IP type of service +T $log->info("IPR: ".substr($helpBin,2,1)); #IP type of service +R $log->info("IPECT: ".substr($helpBin,1,1)); #IP type of servic +e ECN-capable transport (ECT) $log->info("IPECNCE: ".substr($helpBin,0,1)); # IP type of ser +vice ECN-CE $log->info("IPDALE: ".$ip->{'len'}); #total length of the IP d +atagram $log->info("IPID: ".$ip->{'id'}); #IP packet ID $log->info("IPFO: ".$ip->{'foffset'}); #IP fragment offset $log->info("IPTTL: ".$ip->{'ttl'}); #IP Time To Live $log->info("IPPRO: ".$ip->{'proto'}); #IP protocol $log->info("IPOPT: ".$ip->{'options'}); #IP options $log->info("IPVER: ".$ip->{'ver'}); #IP version $helpDec = sprintf("%d", $ip->{'flags'}); $helpBin = unpack("B*", pack('C',$helpDec)); $log->info("IPMF: ".substr($helpBin,7,1)); #IP flag More Fragm +ents (MF) $log->info("IPDF: ".substr($helpBin,6,1)); #IP flag Dont Fragm +ent (DF) $log->info("TCPWS: ".$tcp->{'winsize'}); #TCP window size $log->info("TCPACKNO: ".$tcp->{'acknum'}); #TCP Acknowledge nu +mber $log->info("TCPSEQNO: ".$tcp->{'seqnum'}); #TCP sequence numbe +r $log->info("TCPUP: ".$tcp->{'urg'}); #TCP urgent pointer $log->info("TCPOPT: "."0b".$tcp->{'options'}); #TCP options $helpDec = sprintf("%d", $ip->{'flags'}); $helpBin = unpack("B*", pack('C',$helpDec)); $log->info("TCPFLAG: ".$helpBin); #TCP binary flag $log->info("Or: ".$helpDec); #TCP binary flag $log->info("or: ".$ip->{'flags'}); #TCP binary flag $log->info("TCPACK: ".substr($helpBin,6,1)); #TCP flag ACK $log->info("TCPPSH: ".substr($helpBin,5,1)); #TCP flag PUSH (P +SH) $log->info("TCPRST: ".substr($helpBin,4,1)); #TCP flag RESET ( +RST) $log->info("TCPSYN: ".substr($helpBin,3,1)); #TCP flag SYN $log->info("TCPFIN: ".substr($helpBin,2,1)); #TCP flag FIN if(substr($helpBin,3,1) == 1) { $ctu = 0; } } }
20060621 Janitored by Corion: Added <readmore> tag
In reply to Win32 TCP SYN messages by jschollen
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |