title: filtering packets from a specific ip using perl and Net::Pcap and Net::PcapUtils
body: <p>I've been trying to write a script that filters packets out of a device and from a specific ip address over that device.</p>
  
  <p>I want data to be like the output i get from wireshark when you select a specific device and you use the ip.src==xx.xx.xx.xx</p>
  
  <p>my program so far is like this</p>
  
  <pre><code>    #!/usr/bin/perl -w
  my $interface='eth1';
  
  sub process_pkt #Packet processing routine 
  {
   my ($user_data,$header, $packet) = @_;
   my $minipacket = substr($packet,0,54); 
   print ("\n## raw: ###\n");
   print ($minipacket);
  print ("\n==Byte# / Hex / Dec / Bin==\n");
   for ($i=0;$i&lt;55;$i++)
   {
   $hexval = unpack('H2',substr($packet,$i,1)); 
   $decval = hex(unpack('H2',substr($packet,$i,1)));
   printf ("%03s-%02s-%03s-%08b\n", $i, $hexval, $decval, $decval);
   }
  }
  # ###################################################################### 
  
  # Here we are invoking the NetPcap module and looping through forever.
  Net::PcapUtils::loop(\&amp;process_pkt, 
   SNAPLEN =&gt; 65536, #Size of data to get from packet
   PROMISC =&gt; 1, #Put in promiscuous mode
  FILTER =&gt; 'tcp', #only pass TCP packets
   DEV =&gt; $interface, ); 
  </code></pre>
  
  <p>and I am getting output
  <img src="https://i.stack.imgur.com/V8Q2D.jpg" alt="output"></p>
  
  <p>now i want to filter out packets that are received on the <strong>eth1</strong> device and from the soruce ip of xx.xx.xx.xx
  can we use the filter option in Net::PcapUtils::loop to do that?
  and then i want packets of data length xx
  ...
  i tried going through the documentation in cpan.org
  but all i find is the options available.. i couldn't find any examples..</p>
  
  <p>can someone please help me out?</p>
  
  <p>improvements:</p>
  
  <p>can i use something like </p>
  
  <pre><code>FILTER =&gt; 'ip src xx.xx.xx.xx'
  </code></pre>
  
  <p>after the </p>
  
  <pre><code>FILTER =&gt; 'tcp'
  </code></pre>
  
  <p>line in the code?
  and can i somehow include the data length of the packet so as to filter the packets of data length = 86?</p>
  
  <hr>
  
  <p>Alternative program i am using to get the payload of the packet:</p>
  
  <pre><code>#!/usr/bin/perl -w
  # #########################
  #
  use Net::PcapUtils;
  use NetPacket::Ethernet qw(:strip);
  use NetPacket::IP;
  use NetPacket::TCP;
  use NetPacket::IP qw(:strip);
  
  my $interface= 'eth1';
  my $snaplen= 65536;
  my $filter='tcp';
  my $promisc = 1;
  my $timeout = 10000 ;
  my $err;
  
  sub process_pkt
  {
      my ($user_data,$header,$packet) = @_;
  
  $ip= NetPacket::IP-&gt;decode(eth_strip($packet));
      $tcp= NetPacket::TCP-&gt;decode($ip-&gt;{data});
      $payload = $tcp-&gt;{data};
      print ("payload: \n ".$payload." \n----end-----\n");
      for($i=0;$i&lt;55;$i++){   
      $hexval = unpack('H2',substr($payload,$i,1));
      open (MYFILE, '&gt;&gt;perldata1.txt');
      print MYFILE ($i." :hex: ". $hexval."\n");
      close (MYFILE);
      }
  }
  
  Net::PcapUtils::loop(\&amp;process_pkt,
              SNAPLEN =&gt; 65536,
              PROMISC =&gt; 1,
              FILTER =&gt; 'tcp',
              FILTER =&gt; 'ip src 129.7.236.40',
              DEV =&gt; $interface, );
  </code></pre>
  
  <p>but am still not able to figure out how to get the length of the data field. :(
  Thanks. </p>