in reply to Re^4: Extract source and destination IP from Sniffer::HTTP???
in thread Extract source and destination IP from Sniffer::HTTP???

Yeah, IP addresses not implemented, but actually it's not too hard to add support for them. This is a patch for Sniffer/HTTP.pm, it's just a simple hack, it's not well tested, and actually there's some issues here, but it should work in most cases:

--- HTTP.pm.orig 2009-02-15 13:00:56.000000000 +0300 +++ HTTP.pm 2009-02-15 13:06:07.000000000 +0300 @@ -277,7 +277,12 @@ $i->{hlen} = 5 if $i->{hlen} < 5; #warn sprintf "Data length: %d/%d", length $i->{data}, $i->{len} - +($i->{hlen}*4); - $self->handle_tcp_packet(substr($i->{data}, 0, $i->{len}-($i->{hlen +}*4)), $ts); + my $conn = $self->handle_tcp_packet(substr($i->{data}, 0, $i->{len} +-($i->{hlen}*4)), $ts); + unless($conn->tcp_connection->dest_host) { + $conn->tcp_connection->dest_host($i->{dest_ip}); + $conn->tcp_connection->src_host($i->{src_ip}); + } + $conn; }; =head2 C<< $sniffer->handle_tcp_packet TCP [, TIMESTAMP] >>

And here's the example of how to get IP addresses in callbacks:

use strict; use warnings; use Sniffer::HTTP; my $VERBOSE = 0; my $debug = 0; my $sniffer = Sniffer::HTTP->new( callbacks => { request => sub { my ( $req, $conn ) = @_; my $src = $conn->tcp_connection->src_host; my $sport = $conn->tcp_connection->src_port; my $dst = $conn->tcp_connection->dest_host; my $dport = $conn->tcp_connection->dest_port; print "Request: $src:$sport -> $dst:$dport\n"; }, response => sub { my ( $res, $req, $conn ) = @_; }, log => sub { print $_[0] if $VERBOSE }, tcp_log => sub { print $_[0] if $VERBOSE > 1 }, }, timeout => 5 * 60, # seconds after which a connection is consid +ered stale stale_connection => sub { my ( $s, $conn, $key ); if ($key) { print "Connection stalled .... $key ....\n" if $debug; $s->log->("Connection $key is stale."); $s->remove_connection($key); } }, ); $sniffer->run('wlan0');

Replies are listed 'Best First'.
Re^6: Extract source and destination IP from Sniffer::HTTP???
by perlpreben (Beadle) on Feb 15, 2009 at 12:50 UTC
    Ahh you guys are awesome! thanks a million. But could I get a quick walk through of where I add the first peice of code? In what line .... since im adding it into a module (that is by the way freaking awesome) i want to make sure i dont mess my module up. So a quick "Preben, add this code ..< code > on line XXX. Thanks again guys!!
      Seems to work now! I cant express how happy i am right now! Thanks a million all u perl gurus!!!!