0

I am trying to run a perl script that i have scripted to dump the packets from my network, i am using the Net:Pcap and netpacket modules.

They are working fine on my and my friend's laptop. but when i port them onto a vm on my server, they dont run at all..

Can someone help me with this please.. and here's my script.

#!/usr/bin/perl -w
# #########################
#
use Net::PcapUtils;
use NetPacket::Ethernet qw(:strip);
use NetPacket::IP;
use NetPacket::TCP;
use NetPacket::IP qw(:strip);
use strict;
use Data::Dumper;
#use warnings;

my $interface= 'eth1';
my $snaplen= 65536;
my $filter='tcp';
my $promisc = 1;
my $timeout = 10000 ;
my $err;
my @array;
my $decval;
my $roomnum;
sub process_pkt
{
    my ($user_data,$header,$packet) = @_;

my $ip= NetPacket::IP->decode(eth_strip($packet));
    my $tcp= NetPacket::TCP->decode($ip->{data});
    my $payload = $tcp->{data}; 
    if(length($payload)==32)
    {
    for(my $decode=0;$decode<32;$decode++)
    {   
    $array[$decode] = unpack('H2',substr($payload,$decode,1));
    #$decval[$decode] = hex($array[$decode]);   
    }
    my $cardnum=$array[28].$array[27].$array[26].$array[25];
    $decval=hex($cardnum);
    my $length= scalar(@array);
    if($array[19] eq '0e'){
     $roomnum='221';
    }
    elsif($array[19] eq '0d'){
     $roomnum='220';
    }
    elsif($array[19] eq '0b'){
     $roomnum='219';
    }
    elsif($array[19] eq '0c'){
     $roomnum='218';
    }
    elsif($array[19] eq '09'){
     $roomnum='204';
    }
    else
    {
     $roomnum='unknown';
    }







    #open (MYFILE, '>>perlarray.txt');
    if($array[22] eq '0c')
        {
            print ( " Decision: Granted:".$array[22]."card number: ".$decval." room num:".$roomnum."\n");
        }
    elsif($array[22] eq '04')
    {
    print ("Decision: Denied:".$array[22]." card number: ".$decval." room num:".$roomnum."\n");
    }
    elsif($array[22] eq '0d')
    {
    print ("Decision: Locked:".$array[22]."card number: ".$decval." room num:".$roomnum."\n");
    }
    else
    {
    print ("Decision: unknown :".$array[22]."  card number: ".$decval." room num:".$roomnum."\n");
    }

#   print MYFILE ( " Data: \n".Dumper(\@array)." \n");
#   print MYFILE ( " Data: \n".Dumper(\@decval)." \n");
#   close (MYFILE);
    }
}

Net::PcapUtils::loop(\&process_pkt,
            SNAPLEN => 65536,
            PROMISC => 1,
            FILTER => 'tcp',
            FILTER => 'ip src 129.7.236.40',
            DEV => $interface, );
3
  • Do you get any error messages? How do you run the script? As perl foo.pl or is foo.pl in your path and you just execute it by name? Is perl at usr/bin/perl?
    – terdon
    Jun 18, 2013 at 14:19
  • @terdon i am running it using perl foo.pl And no... It doesn't give me any errors and yes the perl libraries are at usr/bin/perl Jun 18, 2013 at 16:27
  • So what happens? You just run it and get nothing? Does the script start? Try adding print STDERR "foo\n" or whatever at various points in your script to see if it is executed and how far it gets. Does a minimal Perl script work?
    – terdon
    Jun 18, 2013 at 17:56

3 Answers 3

1

Some hypervisors forbid enabling promiscuous mode on VM's NICs by default, which (depending on what you're doing) could scupper your capture. Check the settings for your VM to make sure that it has the permissions you need.

0

Try using strace to look at your programs interaction with the system. You might find hints about a library not being loadable, or just what it was doing immediately before it failed.

I presume libpcap is installed?

tcpdump works OK?

1
  • yep.. tcpdump works fine n i installed libpcap, pcaputils Jun 18, 2013 at 19:00
0

The problem was the interface i was capturing on didn't have an ip address assigned to it.. it was a VM on a cluster and i got it programmed in such a way that a virtual nic is setup to capture the packets coming in on a port. The admin didn't give it any ip address.

when i set up a random ip address to that interface using

sudo ifconfig <interface> <x.x.x.x>

it worked fine...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .