[ann]pcaplua

[Javier Guerra Giraldez <javier@...>]

yep, a binding for libpcap (http://www.tcpdump.org/)

hosted at http://github.com/javierguerragiraldez/pcaplua

sample usage, this prints the IP number and port of any tcp connection
except ssh:

----------------- sample.lua --------------------------
local p = require "pcaplua"

local cap,devname=pcaplua.new_live_capture ()
print ('using device:', devname)

cap:set_filter ('port not 22')

local starttime = os.time()
local eth,ip,tcp = {},{},{}
cap:setcallback (function (pkt, t, len)
	p.decode_ethernet(pkt,eth)
	p.decode_ip(eth.content, ip)
	if ip.proto == 6 then
		p.decode_tcp(ip.content, tcp)
		if tcp.f_syn and not tcp.f_ack then
			print (string.format("%f  %s:%d => %s:%d", t,
					ip.src, tcp.source_port,
					ip.dst, tcp.dest_port))
		end
	end
end)

print (cap:loop (0))
---------------------------------------------------------------


-- 
Javier