SANS ISC: Sniffers in Perl?!?

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Maybe this will be interesting to the coders out there or possibly inspire someone to solve a problem in a different way...  Download it here: http://handlers.sans.org/khaugsness/tail-pcap.pl

A while back I needed to do some sniffing for very specific packets in Perl.  And I needed to wrap some logic around the packet processing.  Doing regex matching and normal byte filtering in tcpdump wasn't going to be sufficient.  So I wrote a quick little script using a Perl module to interface with the libpcap library.  Everything was straight-forward and well documented until I needed to tail an existing pcap file.  Google failed me.  So through a little trial-and-error I figured out how to solve the problem.  Here is an example script on how to do this.

Lessons learned: it isn't hard to write your own customized sniffer.  Perl and Python have well-documented high-level interfaces that do most of the hard work for you.