I am having some trouble with Net::Pcap. It is giving me strange output that seems to be encoded in some way that is not explained.
If i use Net::Pcap to capture arp packets and then pull out the sender hardware address I get results such as 383163666630 , 383163666638 , 383163666635 , or 415348283078. If I try to pull the sender IP addresses I get things such as 38316366, 3029 , 6329 , or 3829.
The same type of event occurs If I simply try to use Net::Pcap::lookupnet. It tells me that my IP address is 3232236032, when my IP is 192.168.2.3 and it tells me my netmask is 4294967040 when it is 255.255.255.0. Can anyone please explain what's going on, and how to convert this garbage into useful information? cheers!
Update:As requested I have included some example code:
#!/usr/bin/perl -w
use Net::Pcap;
my $dev="eth1";
my $address;
my $netmask;
my $err;
if (Net::Pcap::lookupnet($dev, \$address, \$netmask, \$err)) {
die 'Unable to look up device information for ', $dev, ' - ', $err
+;
}
print "\n The Ip is $address and the mask is $netmask \n";
#!/usr/bin/perl -w
use Net::ARP;
use Net::Pcap;
use NetPacket::Ethernet;
use NetPacket::ARP;
my $dev="eth1";
my $err;
my $capobj=Net::Pcap::open_live($dev,1500,0,0,\$err);
unless (defined $capobj){die 'Unable to create packet capture on devic
+e ', $dev, ' - ', $err;}
my $filter;
Net::Pcap::compile($capobj, \$filter,'arp',0,'4294967040') && die 'Una
+ble to compile packet capture filter';
Net::Pcap::setfilter($capobj, $filter) && die "Unable to set capture f
+ilter!";
Net::ARP::send_packet("eth1","192.168.2.3","192.168.2.101","00:18:de:3
+4:8e:7b","ff:ff:ff:ff:ff:ff","request");
Net::Pcap::loop($capobj, -1 ,\&arp_packets,'') || die "Unable to comp
+lete packet capture! \n";
Net::Pcap::close($capobj);
sub arp_packets{
my ($user_data, $header, $packet)= @_;
my $eth_obj=NetPacket::Ethernet::decode($packet);
my $arp_obj=NetPacket::ARP::decode($eth_obj{'data'}, $eth_obj);
print "Caught packet with source of $arp_obj->{'sha'} at ip $arp_obj->
+{'spa'} \n";
}
Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
Read Where should I post X? if you're not absolutely sure you're posting in the right place.
Please read these before you post! —
Posts may use any of the Perl Monks Approved HTML tags:
- a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
| |
For: |
|
Use: |
| & | | & |
| < | | < |
| > | | > |
| [ | | [ |
| ] | | ] |
Link using PerlMonks shortcuts! What shortcuts can I use for linking?
See Writeup Formatting Tips and other pages linked from there for more info.