Here is a snippet from some code I wrote in 2006 - hopefully this will give you an idea what to do. Note - I have not looked at this since then, and the modules may have changed.
my $SNIFF_NIC = q(\Device\NPF_{6098F1AA-BEB5-49D4-8DEC-9B08EE8CE35C});
...
my %pcap_parameters = (
SNAPLEN => 256, # Num bytes to capture from packet
PROMISCUOUS_MODE => 1, # Operate in promiscuous mode?
TIMEOUT => 1000, # Read timeout (ms)
NUMPACKETS => 0, # Pkts to read (-1 = loop forever)
FILTER => '(ip proto \icmp) or dst port 80 or 135 or 139 or 44
+5 or 3127 or 4444', # Filter string
USERDATA => '', # Passed as first arg to callback fn
SAVEFILE => '', # Default save file
# Items below are RETURNED values from PCap calls.
# Do not attempt to change them in the declaration.
FILTER_HANDLE => 0, # Reference to compiled filter
NETWORK_INTERFACE => '',# Network interface to open
NETWORK_ADDR =>0, # Network Address (32 bit number)
NETWORK_MASK =>0, # Mask (32-bit number)
mode => '', # Internal variable
);
.....
$pcap_parameters{NETWORK_INTERFACE} = $SNIFF_NIC;
### Net::Pcap::lookupdev(\$err) or die "No Network device found:$e
+rr\n";
if ($verbose){
print "Requested device \t[$pcap_parameters{NETWORK_INTERFACE}]\n"
+;
my $dev = Net::Pcap::lookupdev(\$err)
or die "Net::Pcap::lookupdev failed. Error was :$err;\n";
print "Default device:$dev\n;";
my ($error, %description);
print $error if defined $error;
}
$result = Net::Pcap::lookupnet($pcap_parameters{NETWORK_INTERFACE},
\$pcap_parameters{NETWORK_ADDR},
\$pcap_parameters{NETWORK_MASK}, \$err);
$verbose and print "Found Net \tnet " . NetPacket::IP::to_dotquad($p
+cap_parameters{NETWORK_ADDR}) .
" mask " . NetPacket::IP::to_dotquad($pcap_parameters{NETWORK
+_MASK}) . "\n";
....
# Signal handler
$SIG{INT} = 'KeyboardInput';
my $count = 0;
Net::Pcap::loop($pcap_desc, $pcap_parameters{NUMPACKETS}, \&process_pk
+t, "abc");
Net::Pcap::close($pcap_desc);
Yes - this was for a Windows (probably Win2003) system.
Syntactic sugar causes cancer of the semicolon. --Alan Perlis
|