| Net::RawIP(3pm) | User Contributed Perl Documentation | Net::RawIP(3pm) |
Net::RawIP - Perl extension to manipulate raw IP packets with interface to libpcap
This is the documentation of "Net::RawIP" version 0.25
use Net::RawIP;
$n = Net::RawIP->new({
ip => {
saddr => 'my.target.lan',
daddr => 'my.target.lan',
},
});
tcp => {
source => 139,
dest => 139,
psh => 1,
syn => 1,
},
});
$n->send;
$n->ethnew("eth0");
$n->ethset(source => 'my.target.lan', dest =>'my.target.lan');
$n->ethsend;
$p = $n->pcapinit("eth0", "dst port 21", 1500, 30);
$f = dump_open($p, "/my/home/log");
loop($p, 10, \&dump, $f);
This package provides a class which can be used for creating, manipulating and sending raw IP packets with optional features for manipulating Ethernet headers.
Note: Ethernet related methods are implemented on Linux and *BSD only.
As its name implies, this module is quite low-level, and currently duplicates some features with "Net::Pcap". If you prefer a higher-level module (in terms of Perl support), please take a look at "Net::Write", which provides a portable interface to construct and send raw packets on the network.
PCAP_ERRBUF_SIZE PCAP_VERSION_MAJOR PCAP_VERSION_MINOR lib_pcap_h
open_live open_offline dump_open lookupdev lookupnet dispatch loop dump compile setfilter next datalink snapshot is_swapped major_version minor_version stats file fileno perror geterr strerror close dump_close timem linkoffset ifaddrlist rdev
By default exported functions are the loop, dispatch, dump_open, dump, open_live, timem, linkoffset, ifaddrlist, rdev. You have to use the export tag pcap for export all of the pcap functions. Please read the docs for the libpcap and look at Net::RawIP::libpcap(3pm).
Please look at the examples in the examples/ folder of the distribution.
Net::RawIP->new({
ARGPROTO => {PROTOKEY => PROTOVALUE,...}
ip => {IPKEY => IPVALUE,...},
})
ARGPROTO is one of (tcp, udp, icmp, generic) defining the protocol of the current packet. Defaults to tcp.
You can NOT change protocol in the object after its creation. Unless you want your packet to be TCP, you must set the protocol type in the new() call.
The possible values of PROTOKEY depend on the value of ARGPROTO
If ARGPROTO is <tcp> PROTOKEY can be one of (source, dest, seq, ack_seq, doff, res1, res2, urg, ack, psh, rst, syn, fin, window, check, urg_ptr, data).
If ARGPROTO is icmp PROTOKEY can be one of (type, code, check, gateway, id, sequence, unused, mtu, data).
If ARGPROTO is udp PROTOKEY can be one of (source, dest, len, check, data)
If ARGPROTO is generic PROTOKEY can be data only.
The data entries are scalars containing packed network byte order data.
As the real icmp packet is a C union one can specify only one of the following set of values.
The default values are:
The valid values for urg ack psh rst syn fin are 0 or 1. The value of data is a string. Length of the result packet will be calculated if you do not specify non-zero value for tot_len.
The value of ip is a hash defining the parameters of the IP header (iphdr) in the current IP packet.
IPKEY is one of (version, ihl, tos, tot_len, id, frag_off, ttl, protocol, check, saddr, daddr). You can to specify any and all of the above parameters. If check is not given checksum will be calculated automatically.
The values of the saddr and the daddr can be hostname (e.g. www.oracle.com ) or IP address (205.227.44.16), and even the integer value if you happen to know what is 205.227.44.16 as an unsigned int in the host format ;).
Examples:
my $rawip = Net::RawIP->new({udp =>{}});
or
my $rawip = Net::RawIP->new({ip => { tos => 22 }, udp => { source => 22,dest =>23 } });
The default values of the ip hash are
Similar to sprintf("%.6f", Time::HiRes::time());
The input parameter is a hash reference. In this hash can be three keys. They are a ip and an one of the ARGPROTOs. The value must be an array reference. This array contain asked parameters. E.g. you want to know current value of the tos from the iphdr and the flags of the tcphdr. Here is a code :
($tos,$urg,$ack,$psh,$rst,$syn,$fin) = $packet->get({
ip => [qw(tos)],
tcp => [qw(psh syn urg ack rst fin)]
});
The members in the array can be given in any order.
For get the ethernet parameters you have to use the key eth and the values of the array (dest,source,proto). The values of the dest and the source will look like the output of the ifconfig(8) e.g. 00:00:E8:43:0B:2A.
$packet->send(1,10);
The delay could be specified not only as integer but and as 0.25 for sleep to 250 ms or 3.5 to sleep for 3 seconds and 500 ms.
The ARGOFDEST and the ARGOFSOURCE can be given as a string which contain just 6 bytes of the real ethernet address or like the output of the ifconfig(8) e.g. 00:00:E8:43:0B:2A or just an ip address or a hostname of a target, then a mac address will be discovered automatically.
The ethernet frame will be sent with given addresses. By default the source and the dest will be filled with a hardware address of the $device.
NOTE: For use methods which are related to the ethernet you have to before initialize ethernet subclass by ethnew.
@opts = $n->optget(ip => {});
E.g. you want to know just the IP options with the type which equal to 131 and 137. Here is a code:
($t131,$l131,$d131,$t137,$l137,$d137) = $n->optget(
ip =>{
type =>[(131,137)]
} );
$n->optunset('ip');
E.g. you want to unset a TCP and an IP options. Here is a code:
$n->optunset('ip','tcp');
pcap(3), tcpdump(1), RFC 791-793, RFC 768.
Net::Pcap, Net::Pcap::Easy, Net::Pcap::Reassemble, Net::Pcap::FindDevice
Net::Write for an alternative module to send raw packets on the network
Current maintainer is Sébastien Aperghis-Tramoni <sebastien@aperghis.net>
Previous authors & maintainers:
Copyright (c) 1998-2006 Sergey Kolychev. All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.
Steve Bonds <u5rhsiz02@sneakemail.com>
+ work on some endianness bugs and improving code comments
| 2022-10-20 | perl v5.36.0 |