1Net::RawIP(3) User Contributed Perl Documentation Net::RawIP(3)
2
6 Net::RawIP - Perl extension to manipulate raw IP packets with interface
7 to libpcap
8 This is the documentation of "Net::RawIP" version 0.25
10
12 use Net::RawIP;
13 $n = Net::RawIP->new({
15 ip => {
16 saddr => 'my.target.lan',
17 daddr => 'my.target.lan',
18 },
19 });
20 tcp => {
21 source => 139,
22 dest => 139,
23 psh => 1,
24 syn => 1,
25 },
26 });
27 $n->send;
28 $n->ethnew("eth0");
29 $n->ethset(source => 'my.target.lan', dest =>'my.target.lan');
30 $n->ethsend;
31 $p = $n->pcapinit("eth0", "dst port 21", 1500, 30);
32 $f = dump_open($p, "/my/home/log");
33 loop($p, 10, \&dump, $f);
34
36 This package provides a class which can be used for creating,
37 manipulating and sending raw IP packets with optional features for
38 manipulating Ethernet headers.
39 Note: Ethernet related methods are implemented on Linux and *BSD only.
41 As its name implies, this module is quite low-level, and currently
43 duplicates some features with "Net::Pcap". If you prefer a higher-level
44 module (in terms of Perl support), please take a look at "Net::Write",
45 which provides a portable interface to construct and send raw packets
46 on the network.
47
49 PCAP_ERRBUF_SIZE
50 PCAP_VERSION_MAJOR
51 PCAP_VERSION_MINOR
52 lib_pcap_h
53
55 open_live open_offline dump_open lookupdev lookupnet dispatch loop dump
56 compile setfilter next datalink snapshot is_swapped major_version
57 minor_version stats file fileno perror geterr strerror close dump_close
58 timem linkoffset ifaddrlist rdev
59 By default exported functions are the loop, dispatch, dump_open, dump,
61 open_live, timem, linkoffset, ifaddrlist, rdev. You have to use the
62 export tag pcap for export all of the pcap functions. Please read the
63 docs for the libpcap and look at Net::RawIP::libpcap(3pm).
64 Please look at the examples in the examples/ folder of the
66 distribution.
67
69 new
70 Net::RawIP->new({
71 ARGPROTO => {PROTOKEY => PROTOVALUE,...}
72 ip => {IPKEY => IPVALUE,...},
73 })
74 ARGPROTO is one of (tcp, udp, icmp, generic) defining the protcol of
76 the current packet. Defaults to tcp.
77 You can NOT change protocol in the object after its creation.
79 Unless you want your packet to be TCP, you must set the protocol
80 type in the new() call.
81 The possible values of PROTOKEY depend on the value of ARGPROTO
83 If ARGPROTO is <tcp> PROTOKEY can be one of (source, dest, seq,
85 ack_seq, doff, res1, res2, urg, ack, psh, rst, syn, fin, window,
86 check, urg_ptr, data).
87 If ARGPROTO is icmp PROTOKEY can be one of (type, code, check,
89 gateway, id, sequence, unused, mtu, data).
90 If ARGPROTO is udp PROTOKEY can be one of (source, dest, len, check,
92 data)
93 If ARGPROTO is generic PROTOKEY can be data only.
95 The data entries are scalars containing packed network byte order
97 data.
98 As the real icmp packet is a C union one can specify only one of the
100 following set of values.
101 • gateway - (int)
103 • (id and sequence) - (short and short)
105 • (mtu and unused) - (short and short)
107 The default values are:
109 • (0,0,0,0,5,0,0,0,0,0,0,0,0,0xffff,0,0,'') for tcp
111 • (0,0,0,0,0,0,0,0,'') for icmp
113 • (0,0,0,0,'') for udp
115 • ('') for generic
117 The valid values for urg ack psh rst syn fin are 0 or 1. The value
119 of data is a string. Length of the result packet will be calculated
120 if you do not specify non-zero value for tot_len.
121 The value of ip is a hash defining the parameters of the IP header
123 (iphdr) in the current IP packet.
124 IPKEY is one of (version, ihl, tos, tot_len, id, frag_off, ttl,
126 protocol, check, saddr, daddr). You can to specify any and all of
127 the above parameters. If check is not given checksum will be
128 calculated automatically.
129 The values of the saddr and the daddr can be hostname (e.g.
131 www.oracle.com ) or IP address (205.227.44.16), and even the integer
132 value if you happen to know what is 205.227.44.16 as an unsigned int
133 in the host format ;).
134 Examples:
136 my $rawip = Net::RawIP->new({udp =>{}});
138 or
140 my $rawip = Net::RawIP->new({ip => { tos => 22 }, udp => { source => 22,dest =>23 } });
142 The default values of the ip hash are
144 • (4,5,16,0,0,0x4000,64,6,0,0,0) for tcp
146 • (4,5,16,0,0,0x4000,64,17,0,0,0) for udp
148 • (4,5,16,0,0,0x4000,64,1,0,0,0) for icmp
150 • (4,5,16,0,0,0x4000,64,0,0,0,0) for generic
152 dump_open
154 If dump_open opens and returns a valid file descriptor, this
155 descriptor can be used in the perl callback as a perl filehandle.
156 loop
158 dispatch
159 loop and dispatch can run a perl code refs as a callbacks for packet
160 analyzing and printing. the fourth parameter for loop and dispatch
161 can be an array or a hash reference and it can be dereferenced in a
162 perl callback.
163 next
165 next() returns a string (next packet).
166 timem
168 timem() returns a string that looks like sec.microsec, where the sec
169 and the microsec are the values returned by gettimeofday(3). If
170 microsec is less than 100000 then zeros will be added to the left
171 side of microsec for adjusting to six digits.
172 Similar to sprintf("%.6f", Time::HiRes::time());
174 linkoffset
176 The function which called linkoffset returns a number of the bytes
177 in the link protocol header e.g. 14 for a Ethernet or 4 for a Point-
178 to-Point protocol. This function has one input parameter (pcap_t*)
179 that is returned by open_live.
180 ifaddrlist
182 ifaddrlist() returns a hash reference. In this hash keys are the
183 running network devices, values are ip addresses of those devices in
184 an internet address format.
185 rdev
187 rdev() returns a name of the outgoing device for given destination
188 address. It has one input parameter (destination address in an
189 internet address or a domain name or a host byteorder int formats).
190 proto
192 Returns the name of the subclass current object e.g. tcp. No input
193 parameters.
194 packet
196 Returns a scalar which contain the packed ip packet of the current
197 object. No input parameters.
198 set
200 Method for setting the parameters of the current object. The given
201 parameters must look like the parameters for the constructor.
202 bset($packet,$eth)
204 Method for setting the parameters of the current object. $packet is
205 a scalar which contain binary structure (an ip or an eth packet).
206 This scalar must match with the subclass of the current object. If
207 $eth is given and it have a non-zero value then assumed that packet
208 is a ethernet packet,otherwise it is a ip packet.
209 get
211 is a method for get the parameters from the current object. This
212 method returns the array which will be filled with an asked
213 parameters in order as they have ordered in packet if you'd call it
214 with an array context. If this method is called with a scalar
215 context then it returns a hash reference. In that hash will stored
216 an asked parameters as values,the keys are their names.
217 The input parameter is a hash reference. In this hash can be three
219 keys. They are a ip and an one of the ARGPROTOs. The value must be
220 an array reference. This array contain asked parameters. E.g. you
221 want to know current value of the tos from the iphdr and the flags
222 of the tcphdr. Here is a code :
223 ($tos,$urg,$ack,$psh,$rst,$syn,$fin) = $packet->get({
225 ip => [qw(tos)],
226 tcp => [qw(psh syn urg ack rst fin)]
227 });
228 The members in the array can be given in any order.
230 For get the ethernet parameters you have to use the key eth and the
232 values of the array (dest,source,proto). The values of the dest and
233 the source will look like the output of the ifconfig(8) e.g.
234 00:00:E8:43:0B:2A.
235 open_live
237 send($delay,$times)
238 is a method which has used for send raw ip packet. The input
239 parameters are the delay seconds and the times for repeating send.
240 If you do not specify parameters for the send,then packet will be
241 sent once without delay. If you do specify for the times a negative
242 value then packet will be sent forever. E.g. you want to send the
243 packet for ten times with delay equal to one second. Here is a code
244 :
245 $packet->send(1,10);
247 The delay could be specified not only as integer but and as 0.25 for
249 sleep to 250 ms or 3.5 to sleep for 3 seconds and 500 ms.
250 pcapinit($device,$filter,$psize,$timeout)
252 is a method for some a pcap init. The input parameters are a
253 device,a string with a program for a filter,a packet size,a timeout.
254 This method will call the function open_live,then compile the filter
255 string by compile(), set the filter and returns the pointer (pcap_t
256 *).
257 pcapinit_offline($fname)
259 is a method for an offline pcap init.The input parameter is a name
260 of the file which contains raw output of the libpcap dump function.
261 Returns the pointer (pcap_t *).
262 ethnew($device,dest => ARGOFDEST,source => ARGOFSOURCE)
264 is a method for init the ethernet subclass in the current object,
265 $device is a required parameter,dest and source are an optional,
266 $device is an ethernet device e.g. eth0, an ARGOFDEST and an
267 ARGOFSOURCE are a the ethernet addresses in the ethernet header of
268 the current object.
269 The ARGOFDEST and the ARGOFSOURCE can be given as a string which
271 contain just 6 bytes of the real ethernet address or like the output
272 of the ifconfig(8) e.g. 00:00:E8:43:0B:2A or just an ip address or a
273 hostname of a target, then a mac address will be discovered
274 automatically.
275 The ethernet frame will be sent with given addresses. By default
277 the source and the dest will be filled with a hardware address of
278 the $device.
279 NOTE: For use methods which are related to the ethernet you have to
281 before initialize ethernet subclass by ethnew.
282 ethset
284 is a method for set an ethernet parameters in the current object.
285 The given parameters must look like parameters for the ethnew
286 without a $device.
287 ethsend
289 is a method for send an ethernet frame. The given parameters must
290 look like a parameters for the send.
291 send_eth_frame($frame,$times,$delay)
293 is a method for send any ethernet frame which you may construct by
294 hands.$frame is a packed ethernet frame exept destination and source
295 fields(these fields can be setting by ethset or ethnew). Another
296 parameters must look like the parameters for the send.
297 optset(OPTPROTO => { type => [...],data => [...] },...)
299 is a method for set an IP and a TCP options. The parameters for the
300 optset must be given as a key-value pairs. The OPTPROTO,s are the
301 prototypes of the options(ip,tcp),values are the hashes
302 references.The keys in this hashes are type and data. The value of
303 the type is an array reference. This array must be filled with an
304 integers.Refer to a RFC for a valid types.The value of the data also
305 is an array reference. This array must be filled with strings which
306 must contain all bytes from a option except bytes with type and
307 length of an option.Of course indexes in those arrays must be equal
308 for the one option.If type is equal to 0 or 1 then there is no bytes
309 with a length and a data,but you have to specify zero data for
310 compability.
311 optget(OPTPROTO => { type => [...] },...)
313 is a method for get an IP and a TCP options. The parameters for the
314 optget must be given as key-value pairs. The OPTPROTO is the
315 prototype of the options(ip,tcp),the values are the hashes
316 references.The key is the type.The value of the type is an array
317 reference. The return value is an array which will be filled with
318 asked types,lengths,datas of the each type of the option in order as
319 you have asked.If you do not specify type then all
320 types,lengths,datas of an options will be returned. E.g. you want
321 to know all the IP options from the current object. Here is a code:
322 @opts = $n->optget(ip => {});
324 E.g. you want to know just the IP options with the type which equal
326 to 131 and 137. Here is a code:
327 ($t131,$l131,$d131,$t137,$l137,$d137) = $n->optget(
329 ip =>{
330 type =>[(131,137)]
331 } );
332 optunset
334 is a method for unset a subclass of the IP or the TCP options from a
335 current object.It can be used if you won't use options in the
336 current object later. This method must be used only after the
337 optset. The parameters for this method are the OPTPROTO's. E.g.
338 you want to unset an IP options. Here is a code:
339 $n->optunset('ip');
341 E.g. you want to unset a TCP and an IP options. Here is a code:
343 $n->optunset('ip','tcp');
345
347 pcap(3), tcpdump(1), RFC 791-793, RFC 768.
348 Net::Pcap, Net::Pcap::Easy, Net::Pcap::Reassemble,
350 Net::Pcap::FindDevice
351 Net::Write for an alternative module to send raw packets on the network
353
355 Current maintainer is Sébastien Aperghis-Tramoni
356 <sebastien@aperghis.net>
357 Previous authors & maintainers:
359 • Sergey Kolychev <ksv@al.lg.ua>
361 • Gabor Szabo <gabor@pti.co.il>
363
365 Copyright (c) 1998-2006 Sergey Kolychev. All rights reserved. This
366 program is free software; you can redistribute it and/or modify it
367 under the same terms as Perl itself.
368
370 Steve Bonds <u5rhsiz02@sneakemail.com>
371 + work on some endianness bugs and improving code comments
372
374 Hey! The above document had some coding errors, which are explained
375 below:
376 Around line 704:
378 Unknown directive: =head
379perl v5.34.0 2021-07-22 Net::RawIP(3)