tcap: [Tcl] pcap interface

homepage: http://monkey.org/~jose/software/tcap/

1. install

edit the makefile for your local paths, then run "make install" as root or via sudo

2. use:

   $ tclsh
   % package require tcap
   % tcap help
    tcap - Tcl pcap(3) interface
    options:
            list
              list all available devices.
            open dev promisc snaplen
              opens a new packet capture interface.
            dloff
              returns the datalink offset in byes.
            filter bpg_program
              sets a bpf(3) filter on the pcap interface.
            get
              returns the next packet as a list of bytes.
            close
              closes the capture interface.

3. more? see test.tcl for some info on how to use tcap



a minimal sniffer in Tcl using tcap:

 #!/usr/bin/env tclsh

 package require tcap

 tcap open fxp0 0 1500
 set dl [tcap dloff]
 tcap filter "tcp"
 while {1} {
         set g [tcap get]
         if {[llength [split $g]] > 0} {
                 puts [lrange $g $dl end]
         }
 }
 tcap close

Tcap was built and tested on [BSD] [UNIX] and [MacOS X], and should work on [Linux]. Testing on [Windows] is incomplete. 

Tcap uses a couple of routines from Dug Song's dsniff utility to streamline the pcap interface. As a result, '''tcap open''' lets you call an interface or a file for parsing.

The tcap command is global, so use Tcl [namespace]s to have more than one sniffer active. 

The '''pcap_inject()''' command is not implemented. For writing packets in Tcl look up [Clif Flynt]'s Packet Master library (a Tcl interface to libdnet). Very useful when combined with tcap. URL: http://noucorp.com/tcl/login/L/packetmstr0_1.zip

Also see [pktsrc], the (formerly) QACafe Tcl packet creation and capture utility.

----

'''[baski] - 2010-02-19 21:52:02'''

Hi Jose,
   I compiled  your tcap tool in linux fedora core but 'tcap get' always returns two hex chars are the output.
thanks
..baski

----
!!!!!!
%| [Category Internet] |%
!!!!!!
----