Net::Pcap or Net::xxxx?? to lookup subnet info...

gardner1 has asked for the wisdom of the Perl Monks concerning the following question:

Hi,

My question is this:

Can I use Net::Pcap or Net::xxxx?? to lookup subnet info for a "foreign" address.

Usage - I am trying to write a PHP + Perl combination of scripts for a work related web application, that in conjuction with Nagios, can auto discover information about the current subnet, and hopefully (this is the related question) tangential subnet's information related to live hosts.

The application - Well, w/o giving up too much info =) I want to create a front end to setting up Nagios on the fly with as much auto-discovered information about connected hosts, both on the current subnet from the installed base, and if possible info on connected hosts on subnets that are Grokkable beyond the current subnet.

Progress so far - I have written enough code in PHP and perl to be able to lookup live hosts and their port info based upon (my testing front end form) a beginning and an ending IP range. This of course I can do 'as_long_as_I_know' which range of addresses to query, and using that method, of course, I don't really need to know whether or not its the current subnet or not....

But, I am trying to develop this as a support application to be installed on "any" private network, and let the script do the work of "crawling" the current and/or appended networks, obviously up until they are met with squashing/filtering gateways, routers, firewalls etc...

I don't care if I fail on a search of a subnet, I just want to know where the query fails, and what info about that failure it gives back, e.g., what ports "are" open at that dead end...

I am not attempting to grok any info, other than is_alive, or not, in order to map that info into the hosts.cfg, services.cfg, hostgroups.cfg, that would in turn then come back to me (my script's logic) to map that info into the dependencies.cfg, checkcommands.cfg, etc... so that I don't really have to DO any work in order to setup Nagios.

nest pas?

any help appreciated. TIA, El Rico

Comment on Net::Pcap or Net::xxxx?? to lookup subnet info...

Replies are listed 'Best First'.
Re: Net::Pcap or Net::xxxx?? to lookup subnet info... by neilh (Pilgrim) on Oct 25, 2004 at 01:39 UTC
G'day gardner1, As far as I am aware Net::Pcap is only useful for "local" networks and not looking up foreign information. That is, you must be directly connected to the network, and have the traffic passing through one of your local network connections, either as a passive sniffer or directly routed traffic. You could use something like Nmap to explore the remote networks and parse the information using perl into Nagios configuration files. What information do you already have? Neil	[reply]
Re: Net::Pcap or Net::xxxx?? to lookup subnet info... by Steve_p (Priest) on Oct 25, 2004 at 03:14 UTC
Right now, nothing else will quite give you that information. I'm working on Net::Libnet, but it's still a long ways from being something that you could use. If your up to it, writing a C program with `libpcap` and `libnet` could get you the information you're looking for.	[reply]
Re^2: Net::Pcap or Net::xxxx?? to lookup subnet info... by gardner1 (Initiate) on Oct 25, 2004 at 04:52 UTC
Thank you to both! I will take a close look at Net::Libnet, and to answer previous, yes, I am currently using nmap at the command line, and Net::Pcap/PcapUtils give me a bit more extensibility. So, I presume, the first step that a user of my form will have to take will be incumbent upon their knowledge of the nets they know about.	[reply]