# -sam k (commport5@lucidx.com)

use POSIX qw(strftime);
use Socket;
use pdump::Sniff;

sub check_rarp {
 my ($nite,$headers,$df,$trgt,@nda,@ndb,$totl,@ints,$vers,$ihl,$tos,$tot,$id,$frg,$ttl,$pro,$chc,$saddr,$daddr,$sport,$dport,$seq,$aseq,$dof,$res1,$res2,$urg,$ack,$psh,$rst,$syn,$fin,$win,$chk,$data,$len,$mtu,$iid,$type,$code,$gateway,$unu,@tmrp) = (0);
 my ($packet_all,$alla,$call,$nite,$time,$untm) = @_;
 my (%etha) = ethernet_decode($call);
 my (%rarpa) = rarp_decode($etha{data});
 $rarpa{sha} =~ s/(.{2})/$1:/g;
 $rarpa{sha} =~ s/:$//;
 $rarpa{sha} =~ s/0([^:]{1})/$1/g;
 $rarpa{spa} =~ s/(.{2})/$1./g;
 $rarpa{spa} =~ s/\.$//;
 $rarpa{spa} =~ s/([^\.]{2})/hex($1)/eg;
 $siaddr = inet_aton($rarpa{spa});
 $rarpa{shsa} = (gethostbyaddr($siaddr, AF_INET))[0];
 if (!$rarpa{shsa}) {
  $rarpa{shsa} = $rarpa{spa};
 }
 $rarpa{tpa} =~ s/(.{2})/$1./g;
 $rarpa{tpa} =~ s/\.$//;
 $rarpa{tpa} =~ s/([^\.]{2})/hex($1)/eg;
 $siaddr = inet_aton($rarpa{tpa});
 $rarpa{thsa} = (gethostbyaddr($siaddr, AF_INET))[0];
 if (!$rarpa{thsa}) {
  $rarpa{thsa} = $rarpa{tpa};
 }
 $rarpp++;
 if ($tstm != 1 and $tstm != 2) {
  print strftime "%H:%M:%S", localtime;
  print ".$time ";
 }
 if ($tstm == 2) {
  print "$untm.$time ";
 }
 print "rarp ";
 if ($rarpa{opcode} == 3) {
  print "who-has $rarpa{thsa} tell $rarpa{shsa}\n";
 }
 elsif ($rarpa{opcode} == 4) {
  print "reply $rarpa{shsa} is-at $rarpa{sha}\n";
 }
 if ($amt and $top == $amt) {
  die "$amt packets recieved by filter\n";
 }
}

1;