targetsmart has asked for the wisdom of the Perl Monks concerning the following question:

I have faced a problem while using Net::RawIP module, I thought that it is not the problem with Net::RawIP module itself and the problem lies with my setup and the way that I use it, so I am posting it here.
I am reading a wireshark dump file using Net::Pcap module,
and I am dumping only the packet to the ethernet interface, using Net::RawIP's bset and send.
I works for some dump files and not for other dump files, it is showing this error
PROBLEM OUTPUT 1
$VAR1 = { 'len' => 74, 'tv_usec' => 134541, 'tv_sec' => 1235622359, 'caplen' => 74 }; >#®w;!áüE<²@ÿjP ùPZ(Ñ0Hk½9å r[àçÚÌ«½UZP<2E5÷B< panic: sv_setpvn called with negative strlen at /usr/local/lib/perl/5.8.8/Net/RawIP.pm line 500 (#1) (P) An internal error. ^[[?1;2cUncaught exception from user code: panic: sv_setpvn called with negative strlen at /usr/local/lib +/perl/5.8.8/Net/RawIP.pm line 500. at /usr/local/lib/perl/5.8.8/Net/RawIP.pm line 500 Net::RawIP::bset('Net::RawIP=HASH(0x814ec28)', '\x{0}#\x{4}\x{ +ae}w;\x{0}!\x{e1}\x{fc}\x{9f}\x{f1}\x{8}\x{0}E\x{0}\x{0}<\x{7}\x{b2}\ +x{0}\x{0}@\x{11}\x{ff}j\x{14}\x{1}P\x{1b}\x{a}\x{80}\x{4}\x{f9}\x{14} +P\x{14}Z\x{0}(\x{d1}0\x{80}\x{12}\x{93}Hk\x{bd}9\x{e5}\x{9}\x{9f}r[\x +{e0}\x{e7}\x{da}\x{5}\x{cc}\x{ab}\x{11}...', 'eth0') called at readpc +ap.pl line 48 main::handlepacket('Testing', 'HASH(0x840a63c)', '\x{0}#\x{4}\ +x{ae}w;\x{0}!\x{e1}\x{fc}\x{9f}\x{f1}\x{8}\x{0}E\x{0}\x{0}<\x{7}\x{b2 +}\x{0}\x{0}@\x{11}\x{ff}j\x{14}\x{1}P\x{1b}\x{a}\x{80}\x{4}\x{f9}\x{1 +4}P\x{14}Z\x{0}(\x{d1}0\x{80}\x{12}\x{93}Hk\x{bd}9\x{e5}\x{9}\x{9f}r[ +\x{e0}\x{e7}\x{da}\x{5}\x{cc}\x{ab}\x{11}...') called at readpcap.pl +line 33

I also checked that for some dump files the capture length was 1500 and for the other the capture length was 65535 (I found it by using file utility in my unix based system). for those files which has capture length of 65535 the net::rawip is saying this error
PROBLEM OUTPUT 2

$VAR1 = { 'len' => 60, 'tv_usec' => 958875, 'tv_sec' => 1235629906, 'caplen' => 60 }; >Â>ðÌ>ð>ð x< Uncaught exception from user code: sendto() at /usr/lib/perl5/Net/RawIP.pm line 550. at /usr/lib/perl5/Net/RawIP.pm line 550 Net::RawIP::send('Net::RawIP=HASH(0x814ec28)') called +at readpcap.pl line 52 main::handlepacket('Testing', 'HASH(0x8410004)', '\x{1 +}\x{80}\x{c2}\x{0}\x{0}\x{e}\x{0}\x{14}\x{e}>\x{f0}\x{0}\x{88}\x{cc}\ +x{2}\x{7}\x{4}\x{0}\x{14}\x{e}>\x{f0}\x{1}\x{4}\x{7}\x{3}\x{0}\x{14}\ +x{e}>\x{f0}\x{b}\x{6}\x{2}\x{0}x\x{0}\x{0}\x{0}\x{0}\x{0}\x{0}\x{0}\x +{0}\x{0}\x{0}\x{0}\x{0}\x{0}\x{0}\x{0}\x{0}\x{0}\x{0}\x{0}\x{0}\x{0}\ +x{0}\x{0}\x{0}') called at readpcap.pl line 35
for the second problem I tried increasing the MTU of ethernet interface from 1500 to 65535 but it is saying error

command: "ifconfig eth2 mtu 65535"
output: "SIOCSIFMTU: Invalid argument"

Any idea about this error and any suggestions to track this problem will be helpful to me.


Vivek
-- In accordance with the prarabdha of each, the One whose function it is to ordain makes each to act. What will not happen will never happen, whatever effort one may put forth. And what will happen will not fail to happen, however much one may seek to prevent it. This is certain. The part of wisdom therefore is to stay quiet.

Replies are listed 'Best First'.
Re: Net::RawIP failing in some case
by lakshmananindia (Chaplain) on Mar 11, 2009 at 12:58 UTC
    ifconfig eth2 mtu 65535

    The maximum transmission unit for an Ethernet is only 1500. I think we can't increase it more than 1500.

    Ethernet can't deal with IP datagrams greater than 1,500 bytes in size.

    If you want you can refer the following link

    Guide
    --Lakshmanan G.

    Your Attempt May Fail, But Never Fail To Make An Attempt

Re: Net::RawIP failing in some case
by Anonymous Monk on Mar 11, 2009 at 12:51 UTC
      From that URL I understood that the multiple encoding is the problem, but how can set to no encoding to rawsocket, how can I just ask perl to just consider the data passed to Net::RawIP's bset routine as only raw data.
      I tried no enconding, use PerlIO , use open, perl -C24 etc, but I couldn't solve the problem.
      Kindly help

      Vivek
      -- In accordance with the prarabdha of each, the One whose function it is to ordain makes each to act. What will not happen will never happen, whatever effort one may put forth. And what will happen will not fail to happen, however much one may seek to prevent it. This is certain. The part of wisdom therefore is to stay quiet.
Re: Net::RawIP failing in some case
by targetsmart (Curate) on Mar 21, 2009 at 13:55 UTC
    I am reading a wireshark dump file using Net::Pcap module,and I want to dump only the packets to the ethernet interface i tried using Net::RawIP module, I was caught up with this 'panic: sv_setpvn called with negative strlen at /usr/local/lib/perl/5.8.8/Net/RawIP.pm line 500.' error if i run the same code on a different machine

    Is there any other module available to write the packets (frames) just to the local Ethernet interface(eth0), because I just want to simulate the exact scenario, my aim is not to send the packet to any external machine but to send only to the local Ethernet interface.

    moreover that module must be free from this encoding issue, it has to process the packet as raw data while parsing the packet and preparing it to send to the Ethernet device.
    because I didn't had success with the Net::RawIP::bset routine.

    Any help is greatly appreciated.


    Vivek
    -- In accordance with the prarabdha of each, the One whose function it is to ordain makes each to act. What will not happen will never happen, whatever effort one may put forth. And what will happen will not fail to happen, however much one may seek to prevent it. This is certain. The part of wisdom therefore is to stay quiet.
      Try adding "use bytes;" at the top of your script. http://perldoc.perl.org/bytes.html