PERL脚本ARP抓包

最新推荐文章于 2021-12-24 09:41:19 发布

ruiqingzheng

最新推荐文章于 2021-12-24 09:41:19 发布

阅读量672

点赞数

本文链接：https://blog.csdn.net/ruiqingzheng/article/details/8675741

版权

#!/usr/bin/perl -w
# Author: ruiqingzheng@gmail.com

use strict;
use Net::Frame::Simple;
use Net::Frame::Dump::Online;
use Net::ARP;
use Net::Frame::Device;

use Getopt::Std;
my %opts;
getopts('i:v', \%opts);

die("Usage: $0\n".
        "\n".
        "-i interface\n".
        "-v be verbose\n".
        "") unless $opts{i};

my $device = Net::Frame::Device->new;
my $onRecvCount = 100;

#print $device -> dev;
my $oDumpEvent = Net::Frame::Dump::Online -> new(
        dev => $device ->dev ,
        filter => 'arp',
        onRecv => \&callOnRecv,
        onRecvCount => $onRecvCount,
        onRecvData => 'description',
);

sub callOnRecv {
        my ($h,$data) = @_;
        #print "\nDescription: $data\n";
        my $oSimple = Net::Frame::Simple -> newFromDump($h);
        my $srcIp = $oSimple -> ref -> {ARP} -> srcIp;
        my $dstIp = $oSimple -> ref -> {ARP} -> dstIp;
        my $opCode = $oSimple -> ref->{ARP} -> opCode;
        print $opCode . " from ".$srcIp ." To ".$dstIp."\n";
        print $oSimple -> print . "\n" if $opts{v};
        print "\n";
}

$oDumpEvent -> start();

运行效果：
root@juey-laptop:~/code# ./capArp.pl -i eth0 -v
1 from 192.168.1.111 To 192.168.1.117
ETH: dst:ff:ff:ff:ff:ff:ff src:00:13:8f:2e:79:73 type:0x0806
ARP: hType:0x0001 pType:0x0800 hSize:0x06 pSize:0x04 opCode:0x0001
ARP: src:00:13:8f:2e:79:73 srcIp:192.168.1.111
ARP: dst:00:00:00:00:00:00 dstIp:192.168.1.117
Padding: 000000000000000000000000000000000000

1 from 192.168.1.111 To 192.168.1.116
ETH: dst:ff:ff:ff:ff:ff:ff src:00:13:8f:2e:79:73 type:0x0806
ARP: hType:0x0001 pType:0x0800 hSize:0x06 pSize:0x04 opCode:0x0001
ARP: src:00:13:8f:2e:79:73 srcIp:192.168.1.111
ARP: dst:00:00:00:00:00:00 dstIp:192.168.1.116
Padding: 000000000000000000000000000000000000

1 from 192.168.1.111 To 192.168.1.115
ETH: dst:ff:ff:ff:ff:ff:ff src:00:13:8f:2e:79:73 type:0x0806
ARP: hType:0x0001 pType:0x0800 hSize:0x06 pSize:0x04 opCode:0x0001
ARP: src:00:13:8f:2e:79:73 srcIp:192.168.1.111
ARP: dst:00:00:00:00:00:00 dstIp:192.168.1.115
Padding: 000000000000000000000000000000000000

阅读(1198) | 评论(0) | 转发(0) |

上一篇：POSTFIX删除队列中的邮件

下一篇：linux putty 中文字符