jschollen has asked for the wisdom of the Perl Monks concerning the following question:

I'm trying to capture network packages that are send to my machine and from my machine.
I use winPcap, along with Net::PcapUtils, NetPacket::Ethernet, NetPacket::IP, NetPacket::TCP. (Recently updated all these packages).
All seems to work fine, but I'm not receiving any SYN packages.
Has anyone any idea what I'm doing wrong?

I'm using Windows XP SP2 and perl 5.8.
The code I use is as follows: 
  @devices = Net::Pcap::findalldevs(\%devinfo, \$err);
  $log->infoDebug("All the devices listed are:");

  for my $dev (@devices)
  {
    $log->infoDebug("$dev : $devinfo{$dev}");

    if($devinfo{$dev} =~ /Broadcom NetXtreme Gigabit/i)
    {
      $log->infoLow("The found DUT network device is $dev : $devinfo{$
+dev}");
      $device = $dev;
      $deviceInfo = $devinfo{$dev};
    }
  }
  
  if($device eq "")
  {
    $stepOk = 0;
    $errorMsg = "Unable to find the DUTs network key. Maybe the DUT is
+ not powered yet.";
    $log->infoError($errorMsg);
  }
  
  if($stepOk)
  {
    if (Net::Pcap::lookupnet($device, \$address, \$netmask, \$err))
    {
      $stepOk = 0;
      $errorMsg = "Unable to look up device information for ".$device.
+' - '.$err;
      $log->infoError($errorMsg);
    }
  }
  
  if($stepOk)
  {
    $netObj = Net::Pcap::open_live($device, 1500, 0, $timeout, \$err);
    unless (defined $netObj)
    {
      $stepOk = 0;
      $errorMsg = "Unable to create packet capture on device ".$device
+.' - '.$err;
      $log->infoError($errorMsg);
    }
  }
  
  if($stepOk)
  {
    $networkDevice = Net::PcapUtils::open(PROMISC => 0);
    if(! ref($networkDevice))
    {
      $stepOk = 0;
      $errorMsg = "Unable to open the network Device: $networkDevice";
      $log->infoError($errorMsg);
    }

    my $amount = 50;
    my $packet = "";
    my %header = ();
    my $ctu    = 1;
    
    for(my $tel = 0; ($tel < $amount) and $ctu; $tel++)
    {
      ($packet,%header) = Net::PcapUtils::next($netObj);
      $log->infoHigh("The return result of the next function is: $pack
+et");
      $log->infoHigh("And:");
      my @key = keys %header;
      for(my $tel = 0; $tel < @key; $tel++)
      {
        $log->infoHigh("The key ".$key[$tel]." has as value: ".$header
+{$key[$tel]});
      }
      
      my $helpDec = "";
      my $helpBin = "";
      my $ip      = "";
      my $tcp     = "";
      
      my $ether_data = NetPacket::Ethernet::strip($packet);
      my $ether_data2 = NetPacket::Ethernet->decode($packet);
      $log->info("ETHNL: ".$ether_data2->{type});
      $log->info("ETHMACSD: ".$ether_data2->{src_mac}." -> ".$ether_da
+ta2->{dest_mac});

      if($ether_data2->{type} == NetPacket::Ethernet::ETH_TYPE_IP) # 2
+048: 0x0800: IPv4
      {
        $ip = NetPacket::IP->decode($ether_data);
        $tcp = NetPacket::TCP->decode($ip->{'data'});
        $log->info("IPADRSD: ".$ip->{'src_ip'}.":".$tcp->{'src_port'}.
+" -> ".$ip->{'dest_ip'}.":".$tcp->{'dest_port'});
        $helpDec = sprintf("%d", $ip->{'tos'});
        $helpBin = unpack("B*", pack('C',$helpDec));
        $log->info("IPPRE: ".substr($helpBin,7,3)); # type of service:
+ precedence.
        $log->info("IPD: ".substr($helpBin,4,1)); #IP type of service 
+D
        $log->info("IPT: ".substr($helpBin,3,1)); #IP type of service 
+T
        $log->info("IPR: ".substr($helpBin,2,1)); #IP type of service 
+R
        $log->info("IPECT: ".substr($helpBin,1,1)); #IP type of servic
+e ECN-capable transport (ECT)
        $log->info("IPECNCE: ".substr($helpBin,0,1)); # IP type of ser
+vice ECN-CE
        $log->info("IPDALE: ".$ip->{'len'}); #total length of the IP d
+atagram
        $log->info("IPID: ".$ip->{'id'}); #IP packet ID
        $log->info("IPFO: ".$ip->{'foffset'}); #IP fragment offset
        $log->info("IPTTL: ".$ip->{'ttl'}); #IP Time To Live
        $log->info("IPPRO: ".$ip->{'proto'}); #IP protocol
        $log->info("IPOPT: ".$ip->{'options'}); #IP options
        $log->info("IPVER: ".$ip->{'ver'}); #IP version
        $helpDec = sprintf("%d", $ip->{'flags'});
        $helpBin = unpack("B*", pack('C',$helpDec));
        $log->info("IPMF: ".substr($helpBin,7,1)); #IP flag More Fragm
+ents (MF)
        $log->info("IPDF: ".substr($helpBin,6,1)); #IP flag Dont Fragm
+ent (DF)

        $log->info("TCPWS: ".$tcp->{'winsize'}); #TCP window size
        $log->info("TCPACKNO: ".$tcp->{'acknum'}); #TCP Acknowledge nu
+mber
        $log->info("TCPSEQNO: ".$tcp->{'seqnum'}); #TCP sequence numbe
+r
        $log->info("TCPUP: ".$tcp->{'urg'}); #TCP urgent pointer
        $log->info("TCPOPT: "."0b".$tcp->{'options'}); #TCP options
        $helpDec = sprintf("%d", $ip->{'flags'});
        $helpBin = unpack("B*", pack('C',$helpDec));
        $log->info("TCPFLAG: ".$helpBin); #TCP binary flag
        $log->info("Or: ".$helpDec); #TCP binary flag
        $log->info("or: ".$ip->{'flags'}); #TCP binary flag
        $log->info("TCPACK: ".substr($helpBin,6,1)); #TCP flag ACK
        $log->info("TCPPSH: ".substr($helpBin,5,1)); #TCP flag PUSH (P
+SH)
        $log->info("TCPRST: ".substr($helpBin,4,1)); #TCP flag RESET (
+RST)
        $log->info("TCPSYN: ".substr($helpBin,3,1)); #TCP flag SYN
        $log->info("TCPFIN: ".substr($helpBin,2,1)); #TCP flag FIN
        
        if(substr($helpBin,3,1) == 1)
        {
          $ctu = 0;
        }
      }
    }

[download]

The $log->info(); $log->infoHigh() and $log->infoError() are a fancy way of logging the data generated to file.

20060621 Janitored by Corion: Added <readmore> tag

Replies are listed 'Best First'.
Re: Win32 TCP SYN messages
by Mr. Muskrat (Canon) on Jun 20, 2006 at 16:13 UTC

    It looks to me like you are looking at the wrong bits. NetPacket::TCP has the following constants defined: 

    use constant FIN => 0x01;
use constant SYN => 0x02;
use constant RST => 0x04;
use constant PSH => 0x08;
use constant ACK => 0x10;
use constant URG => 0x20;
use constant ECE => 0x40;
use constant CWR => 0x80;

    [download]
    Just to test my theory I wrote the following snippet. 
    #!/usr/bin/perl
use strict;
use warnings;

use constant FIN => 0x01;
use constant SYN => 0x02;
use constant RST => 0x04;
use constant PSH => 0x08;
use constant ACK => 0x10;
use constant URG => 0x20;
use constant ECE => 0x40;
use constant CWR => 0x80;

my $helpDec = sprintf("%d", 19); # an arbitrary number that will have 
+the SYN bit set
my $helpBin = unpack("B*", pack('C',$helpDec));

print "TCPFLAG: $helpBin\n";
print "Or: $helpDec\n";

print "TCPACK: " . substr( $helpBin, 6, 1 ) . "\n"; #TCP flag ACK
print "TCPPSH: " . substr( $helpBin, 5, 1 ) . "\n"; #TCP flag PUSH (PS
+H)
print "TCPRST: " . substr( $helpBin, 4, 1 ) . "\n"; #TCP flag RESET (R
+ST)
print "TCPSYN: " . substr( $helpBin, 3, 1 ) . "\n"; #TCP flag SYN
print "TCPFIN: " . substr( $helpBin, 2, 1 ) . "\n"; #TCP flag FIN
print "\n";
print "TCPACK: " . ( $helpDec & ACK ? 1 : 0 ) . "\n"; #TCP flag ACK
print "TCPPSH: " . ( $helpDec & PSH ? 1 : 0 ) . "\n"; #TCP flag PUSH (
+PSH)
print "TCPRST: " . ( $helpDec & RST ? 1 : 0 ) . "\n"; #TCP flag RESET 
+(RST)
print "TCPSYN: " . ( $helpDec & SYN ? 1 : 0 ) . "\n"; #TCP flag SYN
print "TCPFIN: " . ( $helpDec & FIN ? 1 : 0 ) . "\n"; #TCP flag FIN

__END__
TCPFLAG: 00010011
Or: 19
TCPACK: 1
TCPPSH: 0
TCPRST: 0
TCPSYN: 1
TCPFIN: 0

TCPACK: 1
TCPPSH: 0
TCPRST: 0
TCPSYN: 1
TCPFIN: 1

    [download]
    I hope this helps.

[reply]
[d/l]
[select]

      my $helpDec = sprintf("%d", 19);
      is the same as
      my $helpDec = "19";
      but you don't even want a string, so you want
      my $helpDec = 19;

      If you're trying to remove fractional components, use
      my $helpDec = int(19);

[reply]
[d/l]
[select]
        Yes, I know. I was trying to keep as much of the OP's code as possible.
[reply]
      Thx. It works.
      I can't believe I missed that part.
[reply]

Back to Seekers of Perl Wisdom