Capturing and Analyzing Packets with Perl

While many useful tools exist to aid the intrusion analyst in reviewing packet information such as Wireshark and Snort, sometimes they don't do exactly what you need them to do. What if you need to manipulate the data in a field before logging it, need to use your own timestamp format, or need to get more granular in the capture logic than the capturing or logging than the tool allowed? Getting full control over the logic and output usually means creating your own program, which many analysts will find too hard to do. This paper will go through the steps in setting up a Windows system with Perl and the necessary add-ons to be able to run and create packet capturing Perl scripts. It will develop and demonstrate some sample Perl scripts that can be run or modified by the reader to accomplish a packet analysis task. In short, it will provide a foundation for how to capture and analyze packets with Perl.