Here is the beginning of some code I wrote 5 years ago.. /msg me if you need more.

The header will give you an idea about what you need to install, to get started.

#!/usr/bin/perl -w
#
# Network Traffic Analyzer
# -------------------------
# May 2003, by Netwallah 
#
# This program analyzes network traffic, and reports on packets captur
+ed.
# It uses the "pcap" interface (winpcap for Win32 : http://winpcap.pol
+ito.it).
# It uses Net::pcap. Win32 version of this is at http://www.bribes.org
+/perl/wnetpcap.html
# To use this, you may also need to do the following commands:
#   ppm install Data-HexDump
#   ppm install NetPacket
#   ppm install http://www.bribes.org/perl/ppm/Net-Pcap.ppd
#   ppm install http://www.bribes.org/perl/ppm/Net-PcapUtils.ppd
######################################################################
+###

use strict;
use English;
use Net::Pcap;
use NetPacket::Ethernet qw(:types);
use NetPacket::IP qw(:protos);
use NetPacket::ARP qw(:opcodes);
use NetPacket::TCP;
use NetPacket::UDP;
use NetPacket::ICMP qw(:types);
use Data::HexDump;

my( $pcap_desc, $err, $result);
my $verbose = 1;

my %pcap_parameters = (
        SNAPLEN => 124,         # Num bytes to capture from packet
    PROMISCUOUS_MODE => 1,  # Operate in promiscuous mode?
        TIMEOUT => 1000,        # Read timeout (ms)
        NUMPACKETS => 500,       # Pkts to read (-1 = loop forever)
        #FILTER => 'ip proto \icmp',           # Filter string
        FILTER => 'arp or udp dst port 161',           # Filter string
    USERDATA => '',         # Passed as first arg to callback fn
    SAVEFILE => '',         # Default save file

        # Items below are RETURNED values from PCap calls.
        # Do not attempt to change them in the declaration.
        FILTER_HANDLE => 0,     # Reference to compiled filter
        NETWORK_INTERFACE => 'intel',# Network interface to open
        NETWORK_ADDR =>0,       # Network Address (32 bit number)
        NETWORK_MASK =>0,       # Mask (32-bit number)
    mode => '',             # Internal variable
        );

# Partial list from http://www.iana.org/assignments/ethernet-numbers
my %Ethernet_Type_Name = (
           (ETH_TYPE_IP)        =>{NAME=>'IP', DECODER => \&Decode_IP}
+,
           (ETH_TYPE_ARP)       =>{NAME=>'ARP', DECODER => \&Decode_AR
+P},
           (ETH_TYPE_APPLETALK) =>{NAME=>'APPLETALK', DECODER => 0},
            0x8035     =>{NAME=>'RARP', DECODER => \&Decode_ARP}, # (E
+TH_TYPE_RARP is NOT exported!!!)
           (ETH_TYPE_SNMP)      =>{NAME=>'SNMP', DECODER => 0},
           (ETH_TYPE_IPv6)      =>{NAME=>'IPv6', DECODER => 0},
           (ETH_TYPE_PPP)       =>{NAME=>'PPP' ,DECODER => 0}
           );
# Partial list From http://www.iana.org/assignments/protocol-numbers
my %IP_Type_Name = (
    (IP_PROTO_IP)     =>{NAME=>'IP', DECODER=>0},
    (IP_PROTO_ICMP)   =>{NAME=>'ICMP', DECODER=>\&Decode_IP_ICMP},
..snip..
[download]

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.