# -sam k (commport5@lucidx.com)

use POSIX qw(strftime);
use Socket;
use pdump::Sniff;

sub check_arp {
 my ($nite,$headers,$df,$trgt,@nda,@ndb,$totl,@ints,$vers,$ihl,$tos,$tot,$id,$frg,$ttl,$pro,$chc,$saddr,$daddr,$sport,$dport,$seq,$aseq,$dof,$res1,$res2,$urg,$ack,$psh,$rst,$syn,$fin,$win,$chk,$data,$len,$mtu,$iid,$type,$code,$gateway,$unu,@tmrp) = (0);
 my ($packet_all,$alla,$call,$nite,$time,$untm) = @_;
 my (%etha) = ethernet_decode($call);
 my (%arpa) = arp_decode($etha{data});
 $arpa{sha} =~ s/(.{2})/$1:/g;
 $arpa{sha} =~ s/:$//;
 $arpa{sha} =~ s/0([^:]{1})/$1/g;
 $arpa{spa} =~ s/(.{2})/$1./g;
 $arpa{spa} =~ s/\.$//;
 $arpa{spa} =~ s/([^\.]{2})/hex($1)/eg;
 $siaddr = inet_aton($arpa{spa});
 $arpa{shsa} = (gethostbyaddr($siaddr, AF_INET))[0];
 if (!$arpa{shsa}) {
  $arpa{shsa} = $arpa{spa};
 }
 $arpa{tpa} =~ s/(.{2})/$1./g;
 $arpa{tpa} =~ s/\.$//;
 $arpa{tpa} =~ s/([^\.]{2})/hex($1)/eg;
 $siaddr = inet_aton($arpa{tpa});
 $arpa{thsa} = (gethostbyaddr($siaddr, AF_INET))[0];
 if (!$arpa{thsa}) {
  $arpa{thsa} = $arpa{tpa};
 }
 $arpp++;
 if ($tstm != 1 and $tstm != 2) {
  print strftime "%H:%M:%S", localtime;
  print ".$time ";
 }
 if ($tstm == 2) {
  print "$untm.$time ";
 }
 print "arp ";
 if ($arpa{opcode} == 1) {
  print "who-has $arpa{thsa} tell $arpa{shsa}\n";
 }
 elsif ($arpa{opcode} == 2) {
  print "reply $arpa{shsa} is-at $arpa{sha}\n";
 }
 if ($amt and $top == $amt) {
  die "$amt packets recieved by filter\n";
 }
}

1;