如何使用 Perl 即时捕获和编辑网络数据包？
有人知道 Win32 上的 CPAN 模块可以捕获网络数据包并即时编辑它们吗？据我所知，Win32 上唯一处理动态数据包的 Perl 模块是 Net： :Pcap 但它只支持被动监控，不影响 TCP/IP 堆栈。
是否有这样的模块，有人可以提供示例/参考/文档吗？
Does someone know about a CPAN module on Win32 that captures network packets and edit them on the fly? As far as I know, the only Perl module on Win32 that deals with packets on the fly is Net::Pcap but it only support passive monitoring and not affet the TCP/IP stack.
Is there a such module could someone provide example /reference /documentation ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
据我所知，libpcap 允许您读取传入和传出数据包的副本，并且某些实现允许您注入原始数据包，但不能重写数据包。您基本上必须删除原始数据包（libpcap 无法做到这一点），然后在其位置注入一个新数据包。
允许您过滤传入和传出数据包的防火墙应用程序可能能够执行类似的操作。然而，由于您谈论的是 Perl 和 Win32，您的选择可能很有限。
As far as I know, libpcap allows you to read copies of incoming and outgoing packets, and some implementations allow you to inject a raw packet, but not rewrite a packet. You would basically have to drop the original packet (something libpcap cannot do) and then inject a new one in it's place.
Firewall apps that allow you to filter incoming and outgoing packets might be able to do something like this. However, since you're talking about Perl and Win32 your options are probably limited.
我认为正确的答案是“为此实施代理”。
如果它适用于您的场景，请尝试实现代理服务器。在与目标服务相同的端口上侦听并读取所有传入流量。如果您需要修改数据包，请执行此操作并将所有流量传递到目标服务。当然，你必须执行这两个方向。
您可以在 perl 中搜索基本的 TCP 守护程序片段，或者您可以为您的服务的现有代理服务器实现仅模块。是 HTTP 还是您需要处理什么类型的流量？
I think right answer is "implement proxy for this".
If it works in your scenario, try to implement proxy server. Listen on same port as your target service does and read all incoming traffic. If you need modification of packet, do it and pass all traffic to target service. Of course you have to implement both directions.
You can search for basic TCP deamon snippet in perl or maybe you can implement just module for existing proxy server for your service. Is it HTTP or what kind of traffic you need to handle?
我建议使用 Net::Pcap 捕获流量，然后使用 TCPReplay 的 Cygwin 端口进行修改和重放交通。显然，Linux 设置会更可靠，因为 TCPreplay 可以开箱即用，无需 cygwin。
I would suggest using Net::Pcap to capture traffic, then the Cygwin port of TCPReplay to modify and replay the traffic. Obviously a Linux setup would be more reliable since TCPreplay would work on it out of the box without requiring cygwin.