LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > Programming
User Name
Password
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.

Notices



Reply
 
Search this Thread
Old 02-08-2005, 05:23 PM   #1
Barca
LQ Newbie
 
Registered: Nov 2004
Location: Poland
Distribution: Slackware - best and only ;]
Posts: 29

Rep: Reputation: 15
Capture whole packet at once (in Perl)


#!/usr/bin/perl
# ggniuf.pl
# It sniffs packets which are sending by popular polish communicator called
# Gadu-gadu.
# by Barca

use Switch;
use Socket;

#$|++;
$white="";
$dcyan="";
$yellow="";
$gray="";
our $nr = 0;
our %host = ( );

open(STDIN,"tcpdump -lnx -s0 dst port 8074 |") || die "I can't open tcpdump.";
print ":::$dcyan\ GGNiuf started$gray\ :::\n";

while(<>)
{
$packet = <STDIN>;
open(FILE, ">>packet.txt");
print FILE $packet;
close FILE;
}

-----------------------------------------------------------------------------------------------
Hi,
I write some sniffer and I stucked on one problem. As you can see on that little fragment, I need to capture all packets which are sent to hosts on port 8074. After running that, I have whole packet in one piece, in file. So I can read everything to variable and proceed with filtrating data. But it has 2 disadvantages:

1) it can slow down computer when many packets are received (hdd works all the time)
2) In the file, I receive only every second line (!), e.x.:

0x0000: 4500 008e a12b 4000 4006 d5c9 c0a8 0066 E....+@.@......f
0x0020: 8018 07cc 469a 0000 0101 080a 02d4 6ced ....F.........l.
0x0040: b074 7501 0800 0000 3132 3334 3536 3738 .tu.....12345678
0x0060: 6cb3 6d6e 6ff3 7071 7273 9c74 7577 7879 l.mno.pqrs.tuwxy
0x0080: 6667 686a 6b6c 7a78 6376 626e 6d00 fghjklzxcvbnm.
0x0000: 4500 0034 a12d 4000 4006 d621 c0a8 0066 E..4.-@.@..!...f
0x0020: 8010 07cc 7a0b 0000 0101 080a 02d4 6da7 ....z.........m.

Is there any solution to my problems? Or maybe you know better way to capture all packet data in one catch? Please help...
 
Old 02-08-2005, 05:29 PM   #2
Matir
Moderator
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 118Reputation: 118
First off, you are reading from standard input twice for each read. (<> reads into $_)

Secondly, why open and close the file so often? That probably generates most of the overhead.

Try this to replace your while loop (my perl is a bit rusty):

Code:
open(FILE,">>packet.txt");
while(<>)
{
print FILE $_;
}
close FILE;
 
Old 02-08-2005, 06:21 PM   #3
Barca
LQ Newbie
 
Registered: Nov 2004
Location: Poland
Distribution: Slackware - best and only ;]
Posts: 29

Original Poster
Rep: Reputation: 15
Hm, it creates empty file (packet.txt has 0 bytes length).
 
Old 02-08-2005, 07:57 PM   #4
chrism01
Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.6, Centos 5.10
Posts: 16,324

Rep: Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041
while( <FILE> )
specify the filehandle in the while statement
 
Old 02-08-2005, 10:06 PM   #5
Matir
Moderator
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 118Reputation: 118
The filehandle should be <STDIN>. Though I would SERIOUSLY advise against using that name for your filehandle... very bad coding practice to rename STDIN. I suggest using something like CAP, and, as mentioned above, then do
Code:
while(<CAP>) ...
 
Old 02-09-2005, 03:16 AM   #6
Barca
LQ Newbie
 
Registered: Nov 2004
Location: Poland
Distribution: Slackware - best and only ;]
Posts: 29

Original Poster
Rep: Reputation: 15
It changed nothing. I still have file with 0 bytes length ;(
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
how do i read the data in the packet that i have captured after packet capture? gajaykrishnan Programming 23 04-19-2006 06:09 AM
Ethereal Packet capture Help sucram2g Linux - Networking 2 07-20-2005 01:35 PM
How to capture network packet jerrytw Programming 1 01-06-2005 11:28 AM
ICMP Packet capture SaTaN Programming 1 01-20-2004 12:38 AM
Network packet capture avaya Linux - Newbie 2 10-14-2002 10:37 PM


All times are GMT -5. The time now is 12:20 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration