Beefy Boxes and Bandwidth Generously Provided by pair Networks
"be consistent"
 
PerlMonks  

comment on

( [id://3333] : superdoc . print w/replies, xml ) Need Help??
I am having some trouble with Net::Pcap. It is giving me strange output that seems to be encoded in some way that is not explained.

If i use Net::Pcap to capture arp packets and then pull out the sender hardware address I get results such as 383163666630 , 383163666638 , 383163666635 , or 415348283078. If I try to pull the sender IP addresses I get things such as 38316366, 3029 , 6329 , or 3829.

The same type of event occurs If I simply try to use Net::Pcap::lookupnet. It tells me that my IP address is 3232236032, when my IP is 192.168.2.3 and it tells me my netmask is 4294967040 when it is 255.255.255.0. Can anyone please explain what's going on, and how to convert this garbage into useful information? cheers!

Update:As requested I have included some example code:
#!/usr/bin/perl -w use Net::Pcap; my $dev="eth1"; my $address; my $netmask; my $err; if (Net::Pcap::lookupnet($dev, \$address, \$netmask, \$err)) { die 'Unable to look up device information for ', $dev, ' - ', $err +; } print "\n The Ip is $address and the mask is $netmask \n";
#!/usr/bin/perl -w use Net::ARP; use Net::Pcap; use NetPacket::Ethernet; use NetPacket::ARP; my $dev="eth1"; my $err; my $capobj=Net::Pcap::open_live($dev,1500,0,0,\$err); unless (defined $capobj){die 'Unable to create packet capture on devic +e ', $dev, ' - ', $err;} my $filter; Net::Pcap::compile($capobj, \$filter,'arp',0,'4294967040') && die 'Una +ble to compile packet capture filter'; Net::Pcap::setfilter($capobj, $filter) && die "Unable to set capture f +ilter!"; Net::ARP::send_packet("eth1","192.168.2.3","192.168.2.101","00:18:de:3 +4:8e:7b","ff:ff:ff:ff:ff:ff","request"); Net::Pcap::loop($capobj, -1 ,\&arp_packets,'') || die "Unable to comp +lete packet capture! \n"; Net::Pcap::close($capobj); sub arp_packets{ my ($user_data, $header, $packet)= @_; my $eth_obj=NetPacket::Ethernet::decode($packet); my $arp_obj=NetPacket::ARP::decode($eth_obj{'data'}, $eth_obj); print "Caught packet with source of $arp_obj->{'sha'} at ip $arp_obj-> +{'spa'} \n"; }

In reply to Net::Pcap garbage Output by WalkingZero

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post; it's "PerlMonks-approved HTML":



  • Are you posting in the right place? Check out Where do I post X? to know for sure.
  • Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
    <code> <a> <b> <big> <blockquote> <br /> <dd> <dl> <dt> <em> <font> <h1> <h2> <h3> <h4> <h5> <h6> <hr /> <i> <li> <nbsp> <ol> <p> <small> <strike> <strong> <sub> <sup> <table> <td> <th> <tr> <tt> <u> <ul>
  • Snippets of code should be wrapped in <code> tags not <pre> tags. In fact, <pre> tags should generally be avoided. If they must be used, extreme care should be taken to ensure that their contents do not have long lines (<70 chars), in order to prevent horizontal scrolling (and possible janitor intervention).
  • Want more info? How to link or How to display code and escape characters are good places to start.