Help with ARP scan/reverse DNS script
From: Jason Noble (sysadmin_at_polezero.com)
Date: 09/29/04
- Next message: Bob Showalter: "RE: POSIX module"
- Previous message: Errin Larsen: "POSIX module"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
To: beginners@perl.org Date: Wed, 29 Sep 2004 11:07:35 -0400
this script is supposed to take an input like 10.0.1.0/24
and output something like this
HOSTNAME MACADDRESS
node-1 00:30:48:28:E9:7E
node-2 00:30:48:29:12:1A
but it is only returning very few if any results.
anyone have any ideas, or maybe a better way to do this?
#!/usr/bin/perl
use strict;
use Getopt::Std;
use Net::DNS;
use IO::Select;
use Net::Netmask;
my $timeout = 5;
my $nameserver = "10.0.1.240";
my $subnet;
my %host;
my %opts;
getopts('n:', \%opts);
die "Usage: arp-scan_lookup.pl -n 10.0.0.0/24\n"
unless $opts{n};
use Net::Pkt::DescL2;
Net::Pkt::DescL2->new;
use Net::Pkt::Quick;
$subnet = Net::Netmask->new2($opts{n});
my @frames;
for ($subnet->enumerate) {
my $frame = Net::Pkt::Quick->arpRequest(
whoHas => "$_",
tell => $Net::Pkt::Ip,
tellMac => $Net::Pkt::Mac,
toMac => 'broadcast',
);
push @frames, $frame;
}
use Net::Pkt::Dump;
my $dump = Net::Pkt::Dump->new(
filter => "arp",
unlinkAfterAnalyze => 1,
);
$dump->start;
$frames[$_ - 1]->send for $subnet->enumerate;
$dump->stop;
$dump->analyze;
my @replies;
for ($subnet->enumerate) {
my $reply = $frames[$_ - 1]->recv;
next unless $reply;
push @replies, $reply;
}
sub lookup {
my $ip_address = shift;
my $result;
my $res = new Net::DNS::Resolver;
$res->nameservers( $nameserver );
my $bgsock = $res->bgsend( $ip_address );
my $sel = new IO::Select($bgsock);
my @ready = $sel->can_read($timeout);
if (@ready) {
foreach my $sock (@ready) {
if ($sock == $bgsock) {
my $packet = $res->bgread($bgsock);
if ($packet) {
foreach my $rr ($packet->answer) {
my $hostname = $rr->rdatastr;
$hostname =~ s/\.pz.local.//g;
$result = $hostname;
}
}
else {
$result = $ip_address;
}
$bgsock = undef;
}
$sel->remove($sock);
$sock = undef;
}
}
else {
$result = $ip_address;
}
if ( $result eq "" ) { $result = $ip_address; }
return $result;
}
print lookup($_->arpSrcIp), " ", $_->arpSrc, "\n" for @replies;
- Next message: Bob Showalter: "RE: POSIX module"
- Previous message: Errin Larsen: "POSIX module"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
|
