in reply to Re^4: Extract source and destination IP from Sniffer::HTTP???
in thread Extract source and destination IP from Sniffer::HTTP???
Yeah, IP addresses not implemented, but actually it's not too hard to add support for them. This is a patch for Sniffer/HTTP.pm, it's just a simple hack, it's not well tested, and actually there's some issues here, but it should work in most cases:
--- HTTP.pm.orig 2009-02-15 13:00:56.000000000 +0300 +++ HTTP.pm 2009-02-15 13:06:07.000000000 +0300 @@ -277,7 +277,12 @@ $i->{hlen} = 5 if $i->{hlen} < 5; #warn sprintf "Data length: %d/%d", length $i->{data}, $i->{len} - +($i->{hlen}*4); - $self->handle_tcp_packet(substr($i->{data}, 0, $i->{len}-($i->{hlen +}*4)), $ts); + my $conn = $self->handle_tcp_packet(substr($i->{data}, 0, $i->{len} +-($i->{hlen}*4)), $ts); + unless($conn->tcp_connection->dest_host) { + $conn->tcp_connection->dest_host($i->{dest_ip}); + $conn->tcp_connection->src_host($i->{src_ip}); + } + $conn; }; =head2 C<< $sniffer->handle_tcp_packet TCP [, TIMESTAMP] >>
And here's the example of how to get IP addresses in callbacks:
use strict; use warnings; use Sniffer::HTTP; my $VERBOSE = 0; my $debug = 0; my $sniffer = Sniffer::HTTP->new( callbacks => { request => sub { my ( $req, $conn ) = @_; my $src = $conn->tcp_connection->src_host; my $sport = $conn->tcp_connection->src_port; my $dst = $conn->tcp_connection->dest_host; my $dport = $conn->tcp_connection->dest_port; print "Request: $src:$sport -> $dst:$dport\n"; }, response => sub { my ( $res, $req, $conn ) = @_; }, log => sub { print $_[0] if $VERBOSE }, tcp_log => sub { print $_[0] if $VERBOSE > 1 }, }, timeout => 5 * 60, # seconds after which a connection is consid +ered stale stale_connection => sub { my ( $s, $conn, $key ); if ($key) { print "Connection stalled .... $key ....\n" if $debug; $s->log->("Connection $key is stale."); $s->remove_connection($key); } }, ); $sniffer->run('wlan0');
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re^6: Extract source and destination IP from Sniffer::HTTP???
by perlpreben (Beadle) on Feb 15, 2009 at 12:50 UTC | |
by perlpreben (Beadle) on Feb 15, 2009 at 14:26 UTC |