Net::RawIP - Perl extension for manipulate raw ip packets with interface to libpcap

  use Net::RawIP;
  $a = new Net::RawIP;
  $a->set({ip => {saddr => 'my.target.lan',daddr => 'my.target.lan'},
           tcp => {source => 139,dest => 139,psh => 1, syn => 1}});
  $a->send;
  $a->ethnew("eth0");
  $a->ethset(source => 'my.target.lan',dest =>'my.target.lan');    
  $a->ethsend;
  $p = $a->pcapinit("eth0","dst port 21",1500,30);
  $f = dump_open($p,"/my/home/log");
  loop $p,10,\&dump,$f;

This package provides a class object which can be used for creating, manipulating and sending a raw ip packets with optional feature for manipulating ethernet headers.

NOTE: Ethernet related methods are implemented on Linux and *BSD only

  PCAP_ERRBUF_SIZE
  PCAP_VERSION_MAJOR
  PCAP_VERSION_MINOR
  lib_pcap_h

open_live open_offline dump_open lookupdev lookupnet dispatch loop dump compile setfilter next datalink snapshot is_swapped major_version minor_version stats file fileno perror geterr strerror close dump_close timem linkoffset

By default exported functions are the loop,dispatch,dump_open,dump, open_live,timem,linkoffset,ifaddrlist,rdev. You have to use the export tag pcap for export all of the pcap functions. Please read the docs for the libpcap and look at Net::RawIP::libpcap(3pm). The exported functions the loop and the dispatch can run a perl code refs as a callbacks for packet analyzing and printing. If dump_open opens and returns a valid file descriptor,this descriptor can be used in the perl callback as a perl filehandle.Also fourth parameter for loop and dispatch can be an array or a hash reference and it can be unreferensed in a perl callback. The function next returns a string scalar (next packet).Function BItimem() returns a string scalar which looking like sec.microsec, where the sec and the microsec are the values which returned by gettimeofday(3) , if microsec is less than 100000 then zeros will be added to the left side of microsec for adjusting to six digits. The function which called linkoffset returns a number of the bytes in the link protocol header e.g. 14 for a Ethernet or 4 for a Point-to-Point protocol.This function has one input parameter (pcap_t* which is returned by open_live).

The ifaddrlist function returns a hash reference,in this hash keys are all running network devices,values are ip addresses of those devices in an internet address format.

The rdev function returns a name of the outgoing device for given destination address. It has one input parameter (destination address in an internet address or a domain name or a host byteorder int formats).

Please look at the examples.

CBnew ({ ip => {IPKEY => IPVALUE,...}, ARGPROTO => {PROTOKEY => PROTOVALUE,...} })

The CBip is the key of the hash which value is a reference of the hash with parameters of the iphdr in the current IP packet.

The CBIPKEY is one of they (version ihl tos tot_len id frag_off ttl protocol check saddr daddr). You can to specify all parameters,even check.If you do not specify parameter, then value by default will be used. Of course the checksum will be calculated if you do not specify non-zero value for it. The values of the saddr and the daddr can be like www.oracle.com or 205.227.44.16, even they can be an integer if you know what is 205.227.44.16 as an unsigned int in the host format ;).

The CBARGPROTO is one of they (tcp udp icmp generic), this key has used for DEFINE subclass of the Net::RawIP. If you not specify a ARGPROTO then by default value is the tcp.

You HAVE TO initialize the subclass of the Net::RawIP object before use.

Here is a code for initializing the udp subclass in the Net::RawIP object.

$a = new Net::RawIP({udp =>{}});

or

$a = new Net::RawIP({ip => { tos => 22 }, udp => { source => 22,dest =>23 } });

You could NOT change the subclass in the object after.

The default values of the ip hash are (4,5,16,0,0,0x4000,64,6,0,0,0) for the tcp or (4,5,16,0,0,0x4000,64,17,0,0,0) for the udp or (4,5,16,0,0,0x4000,64,1,0,0,0) for the icmp or (4,5,16,0,0,0x4000,64,0,0,0,0) for the generic.

The CBPROTOKEY is one of (source dest seq ack_seq doff res1 res2 urg ack psh rst syn fin window check urg_ptr data) for the tcp or

one of (type code check gateway id sequence unused mtu data) for the icmp or

one of (source dest len check data) for the udp or just

data for the generic.

You have to specify just gateway - (int) or (id and sequence) - (short and short) or (mtu and unused) - (short and short) for the icmp because in the real icmp packet it's the C union.

The default values are (0,0,0,0,5,0,0,0,0,0,0,0,0,0xffff,0,0,'') for the tcp and (0,0,0,0,0,0,0,0,'') for the icmp and (0,0,0,0,'') for the udp and ('') for the generic.

The valid values for urg ack psh rst syn fin are 0 or 1. The value of data is a string. Length of the result packet will be calculated if you do not specify non-zero value for tot_len.

proto

returns the name of the subclass current object e.g. tcp. No input parameters.

packet

returns a scalar which contain the packed ip packet of the current object. No input parameters.

set

is a method for set the parameters to the current object. The given parameters must look like the parameters for the constructor.

bset($packet,$eth)

is a method for set the parameters for the current object. $packet is a scalar which contain binary structure (an ip or an eth packet). This scalar must match with the subclass of the current object. If $eth is given and it have a non-zero value then assumed that packet is a ethernet packet,otherwise it is a ip packet.

get

is a method for get the parameters from the current object. This method returns the array which will be filled with an asked parameters in order as they have ordered in packet if you'd call it with an array context. If this method is called with a scalar context then it returns a hash reference. In that hash will stored an asked parameters as values,the keys are their names. The input parameter is a hash reference. In this hash can be three keys. They are a ip and an one of the ARGPROTOs. The value must be an array reference. This array contain asked parameters. E.g. you want to know current value of the tos from the iphdr and the flags of the tcphdr. Here is a code :

  ($tos,$urg,$ack,$psh,$rst,$syn,$fin) = $packet->get({
            ip => [qw(tos)],
            tcp => [qw(psh syn urg ack rst fin)]
            });

The members in the array can be given in any order. For get the ethernet parameters you have to use the key eth and the values of the array (dest,source,proto). The values of the dest and the source will look like the output of the ifconfig(8) e.g. 00:00:E8:43:0B:2A.

send($delay,$times)

is a method which has used for send raw ip packet. The input parameters are the delay seconds and the times for repeating send. If you do not specify parameters for the send,then packet will be sent once without delay. If you do specify for the times a negative value then packet will be sent forever. E.g. you want to send the packet for ten times with delay equal to one second. Here is a code : $packet->send(1,10); The delay could be specified not only as integer but and as 0.25 for sleep to 250 ms or 3.5 to sleep for 3 seconds and 500 ms.

pcapinit($device,$filter,$psize,$timeout)

is a method for some a pcap init. The input parameters are a device,a string with a program for a filter,a packet size,a timeout. This method will call the function open_live,then compile the filter string by compile(), set the filter and returns the pointer (pcap_t *).

pcapinit_offline($fname)

is a method for an offline pcap init.The input parameter is a name of the file which contains raw output of the libpcap dump function. Returns the pointer (pcap_t *).

ethnew($device,dest => ARGOFDEST,source => ARGOFSOURCE)

is a method for init the ethernet subclass in the current object, $device is a required parameter,dest and source are an optional, $device is an ethernet device e.g. eth0, an ARGOFDEST and an ARGOFSOURCE are a the ethernet addresses in the ethernet header of the current object. The ARGOFDEST and the ARGOFSOURCE can be given as a string which contain just 6 bytes of the real ethernet address or like the output of the ifconfig(8) e.g. 00:00:E8:43:0B:2A or just an ip address or a hostname of a target, then a mac address will be discovered automatically. The ethernet frame will be sent with given addresses. By default the source and the dest will be filled with a hardware address of the $device. NOTE: For use methods which are related to the ethernet you have to before initialize ethernet subclass by ethnew.

ethset

is a method for set an ethernet parameters in the current object. The given parameters must look like parameters for the ethnew without a $device.

ethsend

is a method for send an ethernet frame. The given parameters must look like a parameters for the send.

send_eth_frame($frame,$times,$delay)

is a method for send any ethernet frame which you may construct by hands.$frame is a packed ethernet frame exept destination and source fields(these fields can be setting by ethset or ethnew). Another parameters must look like the parameters for the send.

optset(OPTPROTO => { type => [...],data => [...] },...)

is a method for set an IP and a TCP options. The parameters for the optset must be given as a key-value pairs. The OPTPROTO,s are the prototypes of the options(ip,tcp),values are the hashes references.The keys in this hashes are type and data. The value of the type is an array reference. This array must be filled with an integers.Refer to a RFC for a valid types.The value of the data also is an array reference. This array must be filled with strings which must contain all bytes from a option except bytes with type and length of an option.Of course indexes in those arrays must be equal for the one option.If type is equal to 0 or 1 then there is no bytes with a length and a data,but you have to specify zero data for compability.

optget(OPTPROTO => { type => [...] },...)

is a method for get an IP and a TCP options. The parameters for the optget must be given as key-value pairs. The OPTPROTO is the prototype of the options(ip,tcp),the values are the hashes references.The key is the type.The value of the type is an array reference. The return value is an array which will be filled with asked types,lengths,datas of the each type of the option in order as you have asked.If you do not specify type then all types,lengths,datas of an options will be returned. E.g. you want to know all the IP options from the current object. Here is a code: @opts = CW$a->optget(ip => {}); E.g. you want to know just the IP options with the type which equal to 131 and 137. Here is a code: ($t131,$l131,$d131,$t137,$l137,$d137) = CW$a->optget( ip =>{ type =>[(131,137)] } );

optunset

is a method for unset a subclass of the IP or the TCP options from a current object.It can be used if you won't use options in the current object later. This method must be used only after the optset. The parameters for this method are the OPTPROTO's. E.g. you want to unset an IP options. Here is a code: $a->optunset('ip'); E.g. you want to unset a TCP and an IP options. Here is a code: $a->optunset('ip','tcp');

Sergey Kolychev <ksv@al.lg.ua>

Copyright (c) 1998,1999 Sergey Kolychev. All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

perl(1),Net::RawIP::libpcap(3pm),tcpdump(1),RFC 791-793,RFC 768.