Bug #47324 for Net-Pcap-Easy: Missing an interface to read from a pcap file

Thu Jun 25 03:38:19 2009 ANDK [...] cpan.org - Ticket created

Subject:

Missing an interface to read from a pcap file

There seems to be no way to pass a pcap object to the constructor. This limits the usage of N:P:E to live interface usage. Maybe something like this would do: my $pc = Net::Pcap::open_offline($file,\$err); die $err if $err; my $npe = Net::Pcap::Easy->new( pcap => $pc, ... ) WDYT?

Thu Jun 25 04:15:11 2009 ANDK [...] cpan.org - Correspondence added

I just wrote this proof of concept patch and it works fine for me. Except that I have to call the loop with $npe->loop; not with 1 while $npe->loop; But actually I see this as an improvement;)

--- /usr/local/share/perl/5.8.8/Net/Pcap/Easy.pmbak 2009-06-25 09:40:03.000000000 +0200 +++ /usr/local/share/perl/5.8.8/Net/Pcap/Easy.pm 2009-06-25 09:45:00.000000000 +0200 @@ -72,41 +72,46 @@ my $this = bless { @_ }, $class; my $err; - my $dev = ($this->{dev}); - unless( $dev ) { - $dev = $this->{dev} = Net::Pcap::lookupdev(\$err); - croak "ERROR while trying to find a device: $err" unless $dev; - } - - my ($network, $netmask); - if (Net::Pcap::lookupnet($dev, \$network, \$netmask, \$err)) { - croak "ERROR finding net and netmask for $dev: $err"; - + my $pcap; + if ($pcap = $this->{pcap}) { + $this->{network} ||= undef; + $this->{netmask} ||= undef; } else { - $this->{network} = $network; - $this->{netmask} = $netmask; - } - - for my $f (grep {m/_callback$/} keys %$this) { - croak "the $f option does not point to a CODE ref" unless ref($this->{$f}) eq "CODE"; - warn "the $f option is not a known callback and will never get called" unless $KNOWN_CALLBACKS{$f}; + my $dev = ($this->{dev}); + unless( $dev ) { + $dev = $this->{dev} = Net::Pcap::lookupdev(\$err); + croak "ERROR while trying to find a device: $err" unless $dev; + } + + my ($network, $netmask); + if (Net::Pcap::lookupnet($dev, \$network, \$netmask, \$err)) { + croak "ERROR finding net and netmask for $dev: $err"; + + } else { + $this->{network} = $network; + $this->{netmask} = $netmask; + } + + for my $f (grep {m/_callback$/} keys %$this) { + croak "the $f option does not point to a CODE ref" unless ref($this->{$f}) eq "CODE"; + warn "the $f option is not a known callback and will never get called" unless $KNOWN_CALLBACKS{$f}; + } + my $ppl = $this->{packets_per_loop}; + $ppl = $this->{packets_per_loop} = $DEFAULT_PPL unless defined $ppl and $ppl > 0; + + my $ttl = $this->{timeout_in_ms} || 0; + $ttl = 0 if $ttl < 0; + + my $snaplen = $this->{bytes_to_capture} || 1024; + $snaplen = $MIN_SNAPLEN unless $snaplen >= 256; + $pcap = $this->{pcap} = Net::Pcap::open_live($dev, $snaplen, $this->{promiscuous}, $ttl, \$err); + croak "ERROR opening pacp session: $err" if $err or not $pcap; } - my $ppl = $this->{packets_per_loop}; - $ppl = $this->{packets_per_loop} = $DEFAULT_PPL unless defined $ppl and $ppl > 0; - - my $ttl = $this->{timeout_in_ms} || 0; - $ttl = 0 if $ttl < 0; - - my $snaplen = $this->{bytes_to_capture} || 1024; - $snaplen = $MIN_SNAPLEN unless $snaplen >= 256; - - my $pcap = $this->{pcap} = Net::Pcap::open_live($dev, $snaplen, $this->{promiscuous}, $ttl, \$err); - croak "ERROR opening pacp session: $err" if $err or not $pcap; if( my $f = $this->{filter} ) { my $filter; - Net::Pcap::compile( $pcap, \$filter, $f, 1, $netmask ) && croak 'ERROR compiling pcap filter'; + Net::Pcap::compile( $pcap, \$filter, $f, 1, $this->{netmask} ) && croak 'ERROR compiling pcap filter'; Net::Pcap::setfilter( $pcap, $filter ) && die 'ERROR Applying pcap filter'; }

Thu Jun 25 04:15:19 2009 ANDK [...] cpan.org - Status changed from 'new' to 'open'

Thu Jun 25 09:44:40 2009 jettero [...] cpan.org - Correspondence added

On Thu Jun 25 04:15:11 2009, ANDK wrote: Show quoted text

> I just wrote this proof of concept patch and it works fine for me.

All my tests pass with your patch applied. I imagine I'll release with this patch installed later today. I issued my git commit with --author "Andreas Koenig <andk--cpan.org>" (only with an actual @ character). I didn't push that to github yet though.. Show quoted text

> $npe->loop; > not with > 1 while $npe->loop;

I have to read the sources more carefully to see why this is the case. Wouldn't it still process in packets_per_loop epochs and still return false at the end of the file? Show quoted text

> But actually I see this as an improvement ;)

Arguably. I wonder if I should consider making NPE::loop() do that automagically. Hrm. -- If riding in an airplane is flying, then riding in a boat is swimming. 109 jumps, 44.4 minutes of freefall, 85.0 freefall miles.

Thu Jun 25 09:44:42 2009 jettero [...] cpan.org - Given to JETTERO

Thu Jun 25 09:51:27 2009 jettero [...] cpan.org - Correspondence added

On Thu Jun 25 09:44:40 2009, JETTERO wrote: Show quoted text

> "Andreas Koenig <andk--cpan.org>" (only with an actual @ character). > I didn't push that to github yet though...

Lies. I accidentally pushed it just now. -- If riding in an airplane is flying, then riding in a boat is swimming. 109 jumps, 44.4 minutes of freefall, 85.0 freefall miles.

Thu Jun 25 21:39:49 2009 jettero [...] cpan.org - Correspondence added

On Thu Jun 25 09:44:40 2009, JETTERO wrote: Show quoted text

> 1 while $npe->loop;

OIC, you can't do this with files because $npe->loop returns immediately with 0 for infinity. That's the very best part of libpcap and Net::Pcap by extension: it's really really consistent. I've chosen to make loop() return the number of processed packets (in the case that there's no error) so you can use the same exact constructs with devs and files. I pushed the changes up to github, if you wanna take a peak and/or offer suggestions. I meant to publish today, but I had a rather long day. -- If riding in an airplane is flying, then riding in a boat is swimming. 109 jumps, 44.4 minutes of freefall, 85.0 freefall miles.

Thu Jun 25 23:57:02 2009 andreas.koenig.7os6VVqR [...] franz.ak.mind.de - Correspondence added

CC:	ANDK [...] cpan.org
Subject:	Re: [rt.cpan.org #47324] Missing an interface to read from a pcap file
Date:	Fri, 26 Jun 2009 05:56:16 +0200
To:	bug-Net-Pcap-Easy [...] rt.cpan.org
From:	andreas.koenig.7os6VVqR [...] franz.ak.mind.de (Andreas J. Koenig)

Show quoted text

>>>>> On Thu, 25 Jun 2009 09:44:41 -0400, "Paul Miller via RT" <bug-Net-Pcap-Easy@rt.cpan.org> said:

Show quoted text

> All my tests pass with your patch applied. I imagine I'll release with > this patch installed later today. I issued my git commit with --author > "Andreas Koenig <andk--cpan.org>" (only with an actual @ character).

Thanks! Show quoted text

> I didn't push that to github yet though..

Show quoted text

>> $npe->loop; >> not with >> 1 while $npe->loop;

Show quoted text

> I have to read the sources more carefully to see why this is the case. > Wouldn't it still process in packets_per_loop epochs and still return false > at the end of the file?

Now I see what I didn't mention: I called it with packets_per_loop => -1, and I think this is usually what you want when you have a file on the disk. Show quoted text

>> But actually I see this as an improvement ;)

Show quoted text

> Arguably. I wonder if I should consider making NPE::loop() do that > automagically. Hrm.

Show quoted text

> On Thu Jun 25 09:44:40 2009, JETTERO wrote:

>> "Andreas Koenig <andk--cpan.org>" (only with an actual @ character). >> I didn't push that to github yet though...

Show quoted text

> Lies. I accidentally pushed it just now.

Cool, very nice. And I see you even added documentation, thank you! -- andreas

Fri Jun 26 06:22:40 2009 jettero [...] cpan.org - Correspondence added

On Thu Jun 25 23:57:02 2009, andreas.koenig.7os6VVqR@franz.ak.mind.de Show quoted text

> packets_per_loop => -1, > > and I think this is usually what you want when you have a file on the > disk.

Probably. You should be able to do that no problem, I just wanted it to work the same for files and devices. This is supposed to be an easy module to use. Show quoted text

> Cool, very nice. And I see you even added documentation, thank you!

No no, thank you. -- If riding in an airplane is flying, then riding in a boat is swimming. 109 jumps, 44.4 minutes of freefall, 85.0 freefall miles.

Fri Jun 26 06:22:42 2009 jettero [...] cpan.org - Status changed from 'open' to 'resolved'