August 1998
Intermediate to advanced
800 pages
39h 20m
English
This program logs
attempts to connect to ports. It uses the Sys::Syslog module (it in
turn wants the syslog.ph library, which may or
may not come with your system) to log the connection attempt as level
LOG_NOTICE and facility LOG_DAEMON. It uses
getsockname to find out what port was connected to
and getpeername to find out what machine made the
connection. It uses getservbyport to convert the
local port number (e.g., 7) into a service name (e.g,
"echo").
It produces entries in the system log file like this:
May 25 15:50:22 coprolith sniffer: Connection from 207.46.131.141 to
207.46.130.164:echo Install it in the inetd.conf file with a line like this:
echo stream tcp nowait nobody /usr/scripts/snfsqrd snifferThe program is shown in Example 17.7.
Example 17-7. backsniff
#!/usr/bin/perl -w
# backsniff - log attempts to connect to particular ports
use Sys::Syslog;
use Socket;
# identify my port and address
$sockname = getsockname(STDIN)
or die "Couldn't identify myself: $!\n";
($port, $iaddr) = sockaddr_in($sockname);
$my_address = inet_ntoa($iaddr);
# get a name for the service
$service = (getservbyport ($port, "tcp"))[0] || $port;
# now identify remote address
$sockname = getpeername(STDIN)
or die "Couldn't identify other end: $!\n";
($port, $iaddr) = sockaddr_in($sockname);
$ex_address = inet_ntoa($iaddr);
# and log the information
openlog("sniffer", "ndelay", "daemon");
syslog("notice", "Connection from %s to %s:%s\n", $ex_address,
closelog();
exit;