x-way/nflog_sniffer.pl

nflog_sniffer.pl · 903 B · Perl Raw

1	#!/usr/bin/perl
2	#
3	# Written by Andreas Jaggi <andreas.jaggi@waterwave.ch> in December 2015
4	#
5
6	use strict;
7	use warnings;
8
9	use nflog;
10	use NetPacket::IP qw(IP_PROTO_UDP);
11	use NetPacket::UDP;
12	use Socket qw(AF_INET AF_INET6);
13	use Net::DNS::Packet;
14
15	my $l;
16
17	sub callback {
18	my ($payload) = @_;
19	if ($payload) {
20	my $ip_obj = NetPacket::IP->decode($payload->get_data());
21	if ($ip_obj->{proto} == IP_PROTO_UDP) {
22	my $packet = new Net::DNS::Packet(\NetPacket::UDP->decode($ip_obj->{data})->{data});
23	if($packet->header->qr){
24	foreach my $answer ( $packet->answer ) {
25	print "answer(".$answer->type.")[".$answer->ttl."]: ".$answer->name." -> ".$answer->rdstring."\n";
26	}
27	}
28	}
29	}
30	return 0;
31	}
32
33	sub cleanup {
34	$l->unbind(AF_INET);
35	$l->close();
36	}
37
38	sub main {
39	$l = new nflog::log();
40	$SIG{INT} = "cleanup";
41	$l->set_callback(\&callback);
42	$l->fast_open(123,AF_INET);
43	$l->try_run();
44	}
45
46	main();