Perl program to listen for incoming ICMP data

systemlordanubis · 02-28-2012, 12:42 AM

Hi All,

I'm needing to make a program that is able to listen for incoming ICMP packets and obtain the MAC address of the calling party (the calling party in this case will always be on the same subnet).

I know that IO::Socket::INET does have an option to listen for ICMP but it doesn't seem to work.

Does anyone know how I could get this sort of program running under perl?

Thanks
Anubis.

Cedrik · 02-28-2012, 04:09 AM

I would add input iptable rule and parse log, eg

Code:

iptables -A INPUT  -p icmp -j LOG --log-prefix "PING: "

And for parsing, something like

Code:

#!/usr/bin/perl

open LOG, 'tail -f /var/log/messages |' or die $!;

while(<LOG>) {
    do {
        /MAC=.*:(..:..:..:..:..:..).*/;
        print "Mac address: $1\n";
   } if /^PING/;
}
close LOG;

systemlordanubis · 02-28-2012, 09:33 PM

Hi Cedrik,

Hmm, that's some very good food for thought, but I wonder how large the log might get considering that there could be quite a number of records to process...

Also, wouldn't the 'tail' eventually close though when the log switches to the next log file?

If I was able to get around a couple of these things, this could actually make some of my processing even easier, I was going to also need a service to listen to TCP/UDP for which I was using a IO::Socket but this could replace a lot of this heavy lifting.

Certainly food for thought.

On another note however and just out of curiosity, is it possible to make and ICMP listneing service?

Thanks
Anubis.

Cedrik · 02-29-2012, 04:04 AM

You have also the possibility to capture network packets, see: Net::Pcap::Easy perl module

http://search.cpan.org/~jettero/Net-....4207/Easy.pod

(with ICMP filter examples)