Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Programming > Ruby > ARP requests

Reply
Thread Tools

ARP requests

 
 
ninny
Guest
Posts: n/a
 
      05-15-2007
Hello,

I have a project to do in ruby witch consist in recover the ARP requests
(who-has) on my local network and take the IP address if nobody answer
to the ARP requests.
I know identify an ARP request with "pcap" but I don't know how to take
the IP address.

If someone want help me, I would be very happy

--
Posted via http://www.ruby-forum.com/.

 
Reply With Quote
 
 
 
 
Robert Klemme
Guest
Posts: n/a
 
      05-15-2007
On 15.05.2007 12:21, ninny wrote:
> I have a project to do in ruby witch consist in recover the ARP requests
> (who-has) on my local network and take the IP address if nobody answer
> to the ARP requests.
> I know identify an ARP request with "pcap" but I don't know how to take
> the IP address.


I am not sure where your problems are but if you want to detect an IP
address you can take this regexp for a start:

/\d{1,3}(?:\.\d{1,3}){3}/

Note that it does not match IPv6 addresses which might or might not be
an issue. Note also, that it might match strings that are not IP addresses.

Kind regards

robert
 
Reply With Quote
 
 
 
 
Rick DeNatale
Guest
Posts: n/a
 
      05-15-2007
On 5/15/07, Abhijit Gadgil <(E-Mail Removed)> wrote:

> Not really sure about how you'd do this in ruby, but I have a
> suggestion, if you are trying to monitor ARP requests on the network
> and also ARP replies I am afraid, you'd not see most (infact all
> except your own) of the ARP replies (standards compliant ARP replies
> are not sent to broadcast MAC address) and you might end up thinking
> nobody replied.


Not sure how to do this from Ruby, but you can put the network adapter
into promiscuous mode. This causes the adapter to pass all traffic
into the OS, not just traffic addressed to the machine. This is how
tools like ethereal do this.

--
Rick DeNatale

My blog on Ruby
http://talklikeaduck.denhaven2.com/

 
Reply With Quote
 
Rick DeNatale
Guest
Posts: n/a
 
      05-15-2007
BTW,

a google search on ruby packet sniffer came up with this:
http://arstechnica.com/articles/colu...x-20051002.ars

which in turn led to this:
http://www.goto.info.waseda.ac.jp/~f...doc/index.html

--
Rick DeNatale

My blog on Ruby
http://talklikeaduck.denhaven2.com/

 
Reply With Quote
 
Eivind Eklund
Guest
Posts: n/a
 
      05-15-2007
On 5/15/07, Rick DeNatale <(E-Mail Removed)> wrote:
> into promiscuous mode. This causes the adapter to pass all traffic
> into the OS, not just traffic addressed to the machine. This is how
> tools like ethereal do this.


pcap will put the interface into promiscuous mode.

The problem is that switches will not forward the traffic.

Unfortunately, I don't know any real solution to the problem.

Eivind.

 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Arp or Proxy Arp Darren Green Cisco 0 02-20-2009 09:38 PM
PIX 501 blocking inside to out arp requests Tyler Cisco 5 05-22-2008 08:00 AM
web requests and mobile requests Fernando Arámburu ASP .Net 1 04-08-2005 07:13 PM
Loss of DNS/ARP responses from Linksys WAG54G nospam Wireless Networking 6 02-15-2005 05:30 PM



Advertisments