filtering packets from a specific ip using perl and Net::Pcap and Net::PcapUtils -

i've been trying write script filters packets out of device , specific ip address on device.

i want data output wireshark when select specific device , use ip.src==xx.xx.xx.xx

my program far this

    #!/usr/bin/perl -w $interface='eth1';  sub process_pkt #packet processing routine  {  ($user_data,$header, $packet) = @_;  $minipacket = substr($packet,0,54);   print ("\n## raw: ###\n");  print ($minipacket); print ("\n==byte# / hex / dec / bin==\n");  ($i=0;$i<55;$i++)  {  $hexval = unpack('h2',substr($packet,$i,1));   $decval = hex(unpack('h2',substr($packet,$i,1)));  printf ("%03s-%02s-%03s-%08b\n", $i, $hexval, $decval, $decval);  } } # ######################################################################   # here invoking netpcap module , looping through forever. net::pcaputils::loop(\&process_pkt,   snaplen => 65536, #size of data packet  promisc => 1, #put in promiscuous mode filter => 'tcp', #only pass tcp packets  dev => $interface, );  

and getting output

now want filter out packets received on eth1 device , soruce ip of xx.xx.xx.xx can use filter option in net::pcaputils::loop that? , want packets of data length xx ... tried going through documentation in cpan.org find options available.. couldn't find examples..

can please me out?

improvements:

can use

filter => 'ip src xx.xx.xx.xx' 

after

filter => 'tcp' 

line in code? , can somehow include data length of packet filter packets of data length = 86?

---

alternative program using payload of packet:

#!/usr/bin/perl -w # ######################### # use net::pcaputils; use netpacket::ethernet qw(:strip); use netpacket::ip; use netpacket::tcp; use netpacket::ip qw(:strip);  $interface= 'eth1'; $snaplen= 65536; $filter='tcp'; $promisc = 1; $timeout = 10000 ; $err;  sub process_pkt {     ($user_data,$header,$packet) = @_;  $ip= netpacket::ip->decode(eth_strip($packet));     $tcp= netpacket::tcp->decode($ip->{data});     $payload = $tcp->{data};     print ("payload: \n ".$payload." \n----end-----\n");     for($i=0;$i<55;$i++){        $hexval = unpack('h2',substr($payload,$i,1));     open (myfile, '>>perldata1.txt');     print myfile ($i." :hex: ". $hexval."\n");     close (myfile);     } }  net::pcaputils::loop(\&process_pkt,             snaplen => 65536,             promisc => 1,             filter => 'tcp',             filter => 'ip src 129.7.236.40',             dev => $interface, ); 

but still not able figure out how length of data field. :( thanks.

#!/usr/bin/perl -w # ######################### # use net::pcaputils; use netpacket::ethernet qw(:strip); use netpacket::ip; use netpacket::tcp; use netpacket::ip qw(:strip); use strict; use data::dumper; #use warnings;  $interface= 'eth1'; $snaplen= 65536; $filter='tcp'; $promisc = 1; $timeout = 10000 ; $err; @array; sub process_pkt {     ($user_data,$header,$packet) = @_;  $ip= netpacket::ip->decode(eth_strip($packet));     $tcp= netpacket::tcp->decode($ip->{data});     $payload = $tcp->{data};      if(length($payload)==32)     {     for(my $decode=0;$decode<32;$decode++)     {        $array[$decode] = unpack('h2',substr($payload,$decode,1));     }     $length= scalar(@array);     open (myfile, '>doorstatus.tab');     if($array[22] eq '0c')         {             print myfile ( " decision: granted\n");         }     elsif($array[22] eq '04')     {     print myfile ("decision: denied\n");     }     elsif($array[22] eq '0d')     {     print myfile ("decision: locked\n");     }     else     {     print myfile ("decision: unknown \n");     }      #print myfile ( " data: \n".dumper(\@array)." \n");      close (myfile);     } }  net::pcaputils::loop(\&process_pkt,             snaplen => 65536,             promisc => 1,             filter => 'tcp',             filter => 'ip src xx.xx.xx.xx',             dev => $interface, ); 

the code filters data coming specific source array , can thing it,