I looked into p0f's source. It appears the format is just a memory dump of the structures you showed earlier.

struct p0f_query q;
recv(c,&q,sizeof(q),MSG_NOSIGNAL)

struct p0f_response r;
send(sock,&r,sizeof(r),MSG_NOSIGNAL)

struct p0f_response* n;
send(sock,n,sizeof(struct p0f_response),MSG_NOSIGNAL)
[download]

In that case, Convert::Binary::C would be simpler to use instead of pack and unpack. (This falls under the "If you know the library that was used to serialize the data, you could potentially use the same library or a port of it to deserialize the data." case I mentioned earlier.)

The layout of a C structure varies by system. If p0f and p0fq.pl are not both executed on the same machine, you'll need to configure your Convert::Binary::C object's ByteOrder and Alignment.

use strict;
use warnings;

use Convert::Binary::C qw( );
use IO::Socket         qw( );
use Net::IP            qw( );

use constant QUERY_MAGIC       => 0x0defaced;
use constant QTYPE_FINGERPRINT => 1;

my %p0h_arch = (
   #ByteOrder => ...,
   #Alignment => ...,
);

{
   die "usage: p0fq.pl p0f_socket src_ip src_port dst_ip dst_port"
      unless @ARGV == 5;

   my $c = Convert::Binary::C
           ->new(%p0h_arch)
           ->parse_file('p0f-query.h');

   # Convert the IPs and pack the request message
   my $src = Net::IP->new($ARGV[1]) or die (Net::IP::Error());
   my $dst = Net::IP->new($ARGV[3]) or die (Net::IP::Error());
   print "$ARGV[1]\n";
   my $query = $c->pack(p0f_query =>
      QUERY_MAGIC,
      QTYPE_FINGERPRINT,
      0x12345678,
      $src->intip(),
      $dst->intip(),
      $ARGV[2],
      $ARGV[4],
   );

   # Open the connection to p0f
   my $sock = IO::Socket::UNIX->new(
      Peer => $ARGV[0],
      Type => SOCK_STREAM,
   )
      or die "Could not create socket: $!\n";

   # Ask p0f
   print $sock $query;
   my $response = <$sock>;  # yuck!
   close $sock;

   # Extract the response from p0f
   my ($magic, $id, $type, $genre, $detail, $dist, $link,
       $tos, $fw, $nat, $real, $score, $mflags, $uptime) =
      $c->unpack(p0h_response => $response);
   die "Bad response magic.\n" if $magic != QUERY_MAGIC;
   die "P0f did not honor our query.\n" if $type == 1;
   die "This connection is not (no longer?) in the cache.\n" if $type 
+== 2;

   # Display result
   print "Genre    : " . $genre . "\n";
   print "Details  : " . $detail . "\n";
   print "Distance : " . $dist . " hops\n";
   print "Link     : " . $link . "\n";
   print "Uptime   : " . $uptime . " hrs\n";
}
[download]

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.