comment on

Ok, after reading perlpacktut, pack/unpack tutorial on perlmonks, I still can not figure out how to properly write the proper pack/unpack.

PowerPC: 192.168.1.1
PC: 192.168.1.2

I am running p0f both on PowerPC and PC as:

p0f -Q /var/run/p0f.sock -0 'dst port 443 and dst host 192.168.1.1'
p0f -Q /var/run/p0f.sock -0 'dst port 443 and dst host 192.168.1.2'

Here is a updated p0fq.pl script which used function DumpString to dump decmal, hex,and character of $query,$response,$magic,$type

my $QUERY_MAGIC = 0x0defaced;
my $QTYPE_FINGERPRINT = 1;

die "usage: p0fq.pl p0f_socket src_ip src_port dst_ip dst_port"
  unless $#ARGV == 4;


sub DumpString {
    my @a = unpack('C*',$_[0]);
    my $o = 0;
    while (@a) {
        my @b = splice @a,0,16;
        my @d = map sprintf("%03d",$_), @b;
        my @x = map sprintf("%02x",$_), @b;
        my $c = substr($_[0],$o,16);
        $c =~ s/[[:^print:]]/ /g;
        printf "%6d %s\n",$o,join(' ',@d);
        print " "x8,join('  ',@x),"\n";
        print " "x9,join('   ',split(//,$c)),"\n";
        $o += 16;
    }
}

# Convert the IPs and pack the request message
my $src = new Net::IP ($ARGV[1]) or die (Net::IP::Error());
my $dst = new Net::IP ($ARGV[3]) or die (Net::IP::Error());
my $query = pack("L L L N N S S", $QUERY_MAGIC, $QTYPE_FINGERPRINT, 0x
+12345678,
                 $src->intip(), $dst->intip(), $ARGV[2], $ARGV[4]);
print "query:\n";
DumpString($query);
# Open the connection to p0f
my $sock = new IO::Socket::UNIX (Peer => $ARGV[0],
                                 Type => SOCK_STREAM);
die "Could not create socket: $!\n" unless $sock;

# Ask p0f
print $sock $query;
my $response = <$sock>;
close $sock;
print "response:\n";
DumpString($response);

# Extract the response from p0f
my ($magic, $id, $type, $genre, $detail, $dist, $link, $tos, $fw,
    $nat, $real, $score, $mflags, $uptime) =
  unpack ("L L C Z20 Z40 c Z30 Z30 C C C s S N", $response);
print "magic:\n";
DumpString($magic);
print "type:\n";
DumpString($type);
die "Bad response magic.\n" if $magic != $QUERY_MAGIC;
die "P0f did not honor our query.\n" if $type == 1;
die "This connection is not (no longer?) in the cache.\n" if $type == 
+2;
# Display result
print "Genre    : " . $genre . "\n";
print "Details  : " . $detail . "\n";
print "Distance : " . $dist . " hops\n";
print "Link     : " . $link . "\n";
print "Uptime   : " . $uptime . " hrs\n";
[download]

On PC:
./p0fq.pl /var/run/p0f.sock 192.168.1.1 0 192.168.1.2 443
On Power PC:
./p0fq.pl /var/run/p0f.sock 192.168.1.2 0 192.168.1.1 443

PC result:

query:
     0 237 172 239 013 001 000 000 000 120 086 052 018 192 168 001 001
        ed  ac  ef  0d  01  00  00  00  78  56  34  12  c0  a8  01  01
                                         x   V   4
    16 192 168 001 002 000 000 187 001
        c0  a8  01  02  00  00  bb  01

response:
     0 237 172 239 013 120 086 052 018 000 076 105 110 117 120 000 000
        ed  ac  ef  0d  78  56  34  12  00  4c  69  6e  75  78  00  00
                         x   V   4           L   i   n   u   x
    16 000 000 000 000 000 000 000 000 000 000 000 000 000 050 046 054
        00  00  00  00  00  00  00  00  00  00  00  00  00  32  2e  36
                                                             2   .   6
    32 044 032 115 101 108 100 111 109 032 050 046 052 032 040 111 108
        2c  20  73  65  6c  64  6f  6d  20  32  2e  34  20  28  6f  6c
         ,       s   e   l   d   o   m       2   .   4       (   o   l
    48 100 101 114 044 032 052 041 000 000 000 000 000 000 000 000 000
        64  65  72  2c  20  34  29  00  00  00  00  00  00  00  00  00
         d   e   r   ,       4   )
    64 000 000 000 000 000 000 101 116 104 101 114 110 101 116 047 109
        00  00  00  00  00  00  65  74  68  65  72  6e  65  74  2f  6d
                                 e   t   h   e   r   n   e   t   /   m
    80 111 100 101 109 000 000 000 000 000 000 000 000 000 000 000 000
        6f  64  65  6d  00  00  00  00  00  00  00  00  00  00  00  00
         o   d   e   m
    96 000 000 000 000 104 105 103 104 032 116 104 114 111 117 103 104
        00  00  00  00  68  69  67  68  20  74  68  72  6f  75  67  68
                         h   i   g   h       t   h   r   o   u   g   h
   112 112 117 116 000 000 000 000 000 000 000 000 000 000 000 000 000
        70  75  74  00  00  00  00  00  00  00  00  00  00  00  00  00
         p   u   t
   128 000 000 000 000 001 000 156 255 000 000 000 000 074 003 000 000
        00  00  00  00  01  00  9c  ff  00  00  00  00  4a  03  00  00
                                                         J
magic:
     0 050 051 051 056 049 049 049 056 049
        32  33  33  38  31  31  31  38  31
         2   3   3   8   1   1   1   8   1
type:
     0 048
        30
         0
Genre    : Linux
Details  : 2.6, seldom 2.4 (older, 4)
Distance : 0 hops
Link     : ethernet/modem
Uptime   : 74 hrs
[download]

PowerPC result:

query:
     0 013 239 172 237 000 000 000 001 018 052 086 120 192 168 001 002
        0d  ef  ac  ed  00  00  00  01  12  34  56  78  c0  a8  01  02
                                             4   V   x
    16 192 168 001 001 000 000 001 187
        c0  a8  01  01  00  00  01  bb

response:
     0 013 239 172 237 018 052 086 120 001 000 000 000 000 000 000 000
        0d  ef  ac  ed  12  34  56  78  01  00  00  00  00  00  00  00
                             4   V   x
    16 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
        00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00

    32 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
        00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00

    48 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
        00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00

    64 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
        00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00

    80 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
        00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00

    96 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
        00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00

   112 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
        00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00

   128 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
        00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00

magic:
     0 050 051 051 056 049 049 049 056 049
        32  33  33  38  31  31  31  38  31
         2   3   3   8   1   1   1   8   1
type:
     0 049
        31
         1
P0f did not honor our query.
[download]

In reply to Re^10: p0fq.pl and pack by macli
in thread p0fq.pl and pack? by macli

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		`&`
	<		`<`
	>		`>`
	[		`[`
	]		`]`

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.