Dear monks
I am trying to write a web application that will get input from the user, run a TCPDUMP command on the server, analyze the output and display it on the web page.
Since it is a time consuming task I used, for a template, the script from the excellent article:
http://www.stonehenge.com/merlyn/LinuxMag/col39.html
In this script I exec another perl script that does the TCPDUMP job.
The thing is that I am unable to retrive the data from the second script as the TCPDUMP command returned the error “tcpdump: socket: Operation not permitted“ (maybe a tty problem?)
Your help please.
This is the main script and the second script:

#!/usr/bin/perl -T
use strict;
$|++;

$ENV{PATH} = "/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/
+sbin";

use CGI qw(:all delete_all escapeHTML);

if (my $session = param('session')) { # returning to pick up session d
+ata
    my $cache = get_cache_handle();
    my $data = $cache->get($session);
    unless ($data and ref $data eq "ARRAY") { # something is wrong
        show_form();
        exit 0;
    }
    print header;
    print start_html(-title => "TCPDUMP Host Results",
                ($data->[0] ? () :
                (-head => ["<meta http-equiv=refresh content=5>"])));
    print h1("TCPDUMP Host Results");
    print pre(escapeHTML($data->[1]));
    print p(i("... continuing ...")) unless $data->[0];
    print end_html;
} elsif (my $host = param('host')) { # returning to select host
    if ($host =~ /^([a-zA-Z0-9.\-]{1,100})\z/) { # create a session
        $host = $1;                 # untainted now
        my $session = get_session_id();
        my $cache = get_cache_handle();
        $cache->set($session, [0, ""]); # no data yet
        if (my $pid = fork) {       # parent does
            delete_all();             # clear parameters
            param('session', $session);
            print redirect(self_url());
        } elsif (defined $pid) {    # child does
            close STDOUT;             # so parent can go on
            unless (open F, "-|") {
                open STDERR, ">&=1";
                exec "/var/www/cgi-bin/tcpdump/scripts/srcGETrootStat.
+pl", $host;
                die "Cannot execute tcpdump: $!";
            }
            my $buf = "";
            while (<F>) {
            $buf .= $_;
            $cache->set($session, [0, $buf]);
        }
        $cache->set($session, [1, $buf]);
        exit 0;
    } else {
     die "Cannot fork: $!";
    }
    } else {
        show_form();
    }
} else {                        # display form
    show_form();
}

exit 0;

sub show_form {
    print header, start_html("TCPDUMP Host"), h1("TCPDUMP");
    print start_form;
    print submit('tcpdump to this host:'), " ", textfield('host');
    print end_form, end_html;
}

sub get_cache_handle {
    require Cache::FileCache;

     Cache::FileCache->new
         ({
            namespace => 'perl',
            username => 'nobody',
            default_expires_in => '30 minutes',
            auto_purge_interval => '4 hours',
        });
}

sub get_session_id {
   require Digest::MD5;
   Digest::MD5::md5_hex(Digest::MD5::md5_hex(time().{}.rand().$$));
}


###################### script 2 ###################

#!/usr/bin/perl

use Term::ANSIColor;
use Socket;

$commandSrcIb = "/usr/sbin/tcpdump -s 44 -vv -i eth1 -nn -c 100 'tcp[2
+2:4] = 0x54202F20' and dst port 80  -w /tmp/srcGetRoot.cap";


&calcNormal($commandSrcIb);


sub calcNormal {
    @subCommand = @_;
    $count = 0;
    @date = qx { date '+%Y-%m-%d %H:%M:%S' };
    chomp($date[0]);
    print "$date[0]\n";
    `$subCommand[0]`;
    open(STDIN,"/usr/sbin/tcpdump -nn -r /tmp/srcGetRoot.cap |") || di
+e "I can't open tcpdump.";
    while (<>) {
            $packet = $_;
            $packetArray = $_;
            $packet =~ s/ (\d+\.\d+\.\d+\.\d+)\.(\d+)\b/ $1 $2 /g;
            @split = split(" ", $packet);
            $activitySRC{$split[2]}++;
            $srcTime[$count] = "$split[0] $split[2]\n";
            $count++;
            
    }


        foreach $host ( sort { $activitySRC{$b} <=> $activitySRC{$a} }
+  keys %activitySRC) {
            if ($activitySRC{$host} > 20) {
                @getHOST = grep(/$host/, @srcTime);
                chomp($getHOST[$#getHOST]); chomp($getHOST[0]);
                @startTime = split(/\:/, $getHOST[0]);
                $startTime = ($startTime[1] * 60) + $startTime[2];
                @endTime = split(/\:/, $getHOST[$#getHOST]);
                $endTime = ($endTime[1] * 60) + $endTime[2];
                $diffTime = $endTime - $startTime;
                $GETPerSec = $activitySRC{$host} / $diffTime;
                print (color(yellow),"$activitySRC{$host} \/ GET for $
+host, $GETPerSec Get Per Second [Total Time $diffTime]",color("reset"
+),"\n");
                undef(@getHOST);
            } else {
                next;
            }

        }
        undef %activitySRC;
        @date = qx { date '+%Y-%m-%d %H:%M:%S' };
        chomp($date[0]);
        print "$date[0]\n";
}
[download]

Regards,
Adi.

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.