root/fwknop/tags/fwknop-0.9.7-pre2/fwknopd

#!/usr/bin/perl -w
#
#############################################################################
#
# File: fwknopd
#
# Purpose: fwknopd implements the server portion of an authorization scheme
#          known as Single Packet Authorization (SPA) that requires only a
#          single encrypted packet to communicate various pieces of
#          information including desired access through a Netfilter policy
#          and/or specific commands to execute on the target system.  The
#          main application of this program is to protect services such as
#          SSH with an additional layer of security in order to make the
#          exploitation of vulnerabilities (both 0-day and unpatched code)
#          much more difficult.  For more information, see the fwknop(8) man
#          page.
#
# Author: Michael Rash (mbr@cipherdyne.org)
#
# Version: 0.9.6
#
# Copyright (C) 2004-2006 Michael Rash (mbr@cipherdyne.org)
#
# License (GNU Public License):
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program; if not, write to the Free Software
#    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
#    USA
#
#############################################################################
#
# $Id$
#

use lib '/usr/lib/fwknop';
use Crypt::CBC;
use Unix::Syslog qw(:subs :macros);
use Net::IPv4Addr qw(ipv4_in_network);
use Net::Pcap;
use NetPacket::IP;
use NetPacket::UDP;
use NetPacket::TCP;
use NetPacket::ICMP;
use NetPacket::Ethernet;
use IPTables::Parse;
use IPTables::ChainMgr;
use Digest::MD5 'md5_base64';
use IO::Socket;
use IO::Handle;
use MIME::Base64;
use Data::Dumper;
use POSIX;
use Getopt::Long;
use strict;

my $config_file = '/etc/fwknop/fwknop.conf';
my $alerting_config_file = '/etc/fwknop/alert.conf';

my $version = '0.9.6';

my %config     = ();
my %cmds       = ();
my %p0f_sigs   = ();
my %p0f        = ();
my @access     = ();
my @ipt_config = ();
my %ipt_access = ();
my %ip_sequences = ();
my %md5_msg_store = ();
my %required_users = ();

my $os_fprint_only = 0;
my $print_version  = 0;
my $print_help     = 0;
my $kill           = 0;
my $restart        = 0;
my $status         = 0;
my $debug          = 0;
my $ipt_list       = 0;
my $ipt_flush      = 0;
my $verbose        = 0;
my $use_gpg        = 0;
my $os_ipt_log     = '';
my $cmdline_intf   = '';
my $warn_msg       = '';
my $die_msg        = '';
my $err_wait_timer     = 30;  ### seconds
my $skipped_first_loop = 0;
my $pcap_sleep_interval = 1;  ### seconds

### mode numbers
my $command_mode = 0;
my $access_mode  = 1;

### default time values
my $knock_interval    = 60;
my $fw_access_timeout = 300;

my $enc_port_offset   = 61000;  ### default offset
my $enc_key           = '';
my $enc_alg           = 'Rijndael';
my $enc_blocksize     = 16;

### packet counters
my $tcp_ctr  = 0;
my $udp_ctr  = 0;
my $icmp_ctr = 0;

### tcp option types
my $tcp_nop_type       = 1;
my $tcp_mss_type       = 2;
my $tcp_win_scale_type = 3;
my $tcp_sack_type      = 4;
my $tcp_timestamp_type = 8;

my %tcp_p0f_opt_types = (
    'N' => $tcp_nop_type,
    'M' => $tcp_mss_type,
    'W' => $tcp_win_scale_type,
    'S' => $tcp_sack_type,
    'T' => $tcp_timestamp_type
);

my $ip_re = '(?:\d{1,3}\.){3}\d{1,3}';

my @args_cp = @ARGV;

### run GetOpt() to get comand line args
&handle_command_line();

&usage(0) if $print_help;

if ($print_version) {
    print "[+] fwknopd v$version by Michael Rash ",
        "<mbr\@cipherdyne.org>\n";
    exit 0;
}

if ($os_fprint_only) {
    print "[+] Entering OS fingerprinting mode.\n";
}

print STDERR "[+] ** Starting fwknopd (debug mode) **\n" if $debug;

### setup to run
&fwknop_init();

if ($config{'AUTH_MODE'} eq 'KNOCK' or $os_fprint_only) {

    ### we are running in traditional port knocking mode
    &knock_loop();

} elsif ($config{'AUTH_MODE'} eq 'FILE_PCAP'
        or $config{'AUTH_MODE'} eq 'ULOG_PCAP'
        or $config{'AUTH_MODE'} eq 'PCAP') {

    ### we are parsing the pcap file created by the ulogd pcap
    ### writer, or in sniffing mode against an interface
    &pcap_loop();
}
exit 0;
#============================ end main ==============================

sub pcap_loop() {

    ### we use both a size and an inode check in the FILE_PCAP and
    ### ULOG_PCAP modes to check if the file has been rotated
    my $pcap_file_size  = 0;
    my $pcap_file_inode = 0;

    ### get pcap opject
    my $pcap_t = &get_pcap_obj();

    if ($config{'AUTH_MODE'} eq 'FILE_PCAP'
            or $config{'AUTH_MODE'} eq 'ULOG_PCAP') {
        ### get file size (we don't need a -e check here because
        ### this is handled in get_pcap_obj()).
        $pcap_file_size = -s $config{'PCAP_PKT_FILE'};

        ### get inode associated with the sniffing file
        $pcap_file_inode = (stat($config{'PCAP_PKT_FILE'}))[1];
    }
    print STDERR "[+] pcap_loop()\n" if $debug;

    my $check_file_ctr = 0;

    for (;;) {

        Net::Pcap::loop($pcap_t, 1, \&pcap_process_pkt, 'fwknop_tag');

        if ($config{'AUTH_MODE'} eq 'FILE_PCAP'
                or $config{'AUTH_MODE'} eq 'ULOG_PCAP') {

            ### check to see if the pcap file has been rotated (we need to
            ### close and re-open)
            if ($check_file_ctr == 10) {
                if (-e $config{'PCAP_PKT_FILE'}) {
                    my $size_tmp  = -s $config{'PCAP_PKT_FILE'};
                    my $inode_tmp = (stat($config{'PCAP_PKT_FILE'}))[1];
                    if ($inode_tmp != $pcap_file_inode
                            or $size_tmp < $pcap_file_size) {

                        ### the file was rotated or shrank, so get new
                        ### pcap_t object
                        Net::Pcap::close($pcap_t);

                        &logr('[+]', "pcap file $config{'PCAP_PKT_FILE'} " .
                            "shrank or was rotated, so re-opening", 0);
                        $pcap_t = &get_pcap_obj();

                        ### set file size and inode
                        $pcap_file_size  = $size_tmp;
                        $pcap_file_inode = $inode_tmp;
                    }
                } else {
                    Net::Pcap::close($pcap_t);
                    &logr('[+]', "pcap file $config{'PCAP_PKT_FILE'} " .
                        "was rotated, so re-opening", 0);
                    $pcap_t = &get_pcap_obj();

                    ### set file size and inode
                    $pcap_file_size  = -s $config{'PCAP_PKT_FILE'};
                    $pcap_file_inode = (stat($config{'PCAP_PKT_FILE'}))[1];
                }
                $check_file_ctr = 0;
            }
            $check_file_ctr++;

            ### always check to see if we need to timeout access for IPs
            ### For AUTH_MODE set to PCAP, knoptm will timeout access
            &timeout_access();
        }

        sleep $pcap_sleep_interval;
    }

    Net::Pcap::close($pcap_t);

    return;
}

sub pcap_process_pkt() {
    my ($tag, $hdr, $pkt) = @_;

    return '' unless $tag eq 'fwknop_tag';
    return '' unless defined $hdr;
    return '' unless defined $pkt;

    my $ether_data = '';
    my $ip         = '';
    my $src_ip     = '';
    my $proto      = '';
    my $transport_obj = '';

    if ($config{'AUTH_MODE'} eq 'ULOG_PCAP') {
        ### The ulogd pcap writer does not include link layer information
        $ip = NetPacket::IP->decode($pkt) or return '';
    } else {
        $ether_data = NetPacket::Ethernet::strip($pkt) or return '';
        $ip = NetPacket::IP->decode($ether_data) or return '';
    }

    ### get the source IP address
    $src_ip = $ip->{'src_ip'} or return '';

    ### get the protocol
    $proto = $ip->{'proto'} or return '';

    if ($proto == 1) {
        $transport_obj = NetPacket::ICMP->decode($ip->{'data'});
    } elsif ($proto == 6) {
        $transport_obj = NetPacket::TCP->decode($ip->{'data'});
    } elsif ($proto == 17) {
        $transport_obj = NetPacket::UDP->decode($ip->{'data'});
    } else {
        return '';
    }

    print STDERR "[+] Received packet (" if $debug;

    ### make sure we have _some_ data in the packet; in practice
    ### any valid SPA message will be longer than 10 bytes, but this
    ### check is better than nothing
    if (defined $transport_obj->{'data'}) {
        my $len = length($transport_obj->{'data'});
        if ($len > 10) {
            print STDERR "$len bytes)\n" if $debug;
        } else {
            print STDERR "$len bytes, not attempting decrypt)\n" if $debug;
            return '';
        }
    } else {
        return '';
    }

    if ($debug) {
        ### make sure not to print non-printable stuff
        my $data_tmp = $transport_obj->{'data'};
        $data_tmp =~ s/[^\x20-\x7e]/NA/g;
        print STDERR "[+] Received data: $data_tmp\n"
            if $debug;
    }

    ### first check to see if we have any matching access directives
    ### (in access.conf) for $src_ip, and if not we will do _nothing_
    ### with this packet.
    my $access_nums_aref = &check_src($src_ip);

    unless ($access_nums_aref) {
        print STDERR "[-] Packet from $src_ip did not match any ",
              "SOURCE blocks in $config{'ACCESS_CONF'}\n" if $debug;
        return '';
    }

    NUM: for my $num (@$access_nums_aref) {
        my $access_vars_href = $access[$num];

        next NUM unless $access_vars_href->{'DATA_COLLECT_MODE'} =~ /PCAP/;

        print STDERR Dumper $access_vars_href if $debug and $verbose;

        ### keep track of which source block we are dealing with from
        ### access.conf
        my $source_block_num = $access_vars_href->{'block_num'};

        ### see if we can decrypt and base64-decode
        my $decrypted_msg = '';
        my $decrypt_algo  = 'Rijndael';
        my $gpg_sign_id   = '';
        if (defined $access_vars_href->{'GPG_REMOTE_ID'}) {
            ### attempt GPG decrypt
            ($decrypted_msg, $gpg_sign_id) =
                    &pcap_GPG_decrypt_msg($transport_obj->{'data'},
                            $access_vars_href);
            $decrypt_algo = 'GPG' if $decrypted_msg;
        }

        if (defined $access_vars_href->{'KEY'} and not $decrypted_msg) {
            $decrypted_msg = &pcap_Rijndael_decrypt_msg($transport_obj->{'data'},
                    $access_vars_href->{'KEY'});
        }

        if ($decrypted_msg) {
            if ($debug) {
                ### make sure not to print non-printable stuff
                my $dec_tmp_msg = $decrypted_msg;
                $dec_tmp_msg =~ s/[^\x20-\x7e]/NA/g;
                print STDERR "[+] Decrypted message: $dec_tmp_msg\n";
            }
        } else {
            print STDERR "[-] Failed decrypt for SOURCE block ",
                "$access_vars_href->{'SOURCE'}\n" if $debug;
            next NUM;
        }

        ### compare with md5 store (note we calculated the md5 sum
        ### against the original encrypted packet since we want to
        ### allow the same command to be executed; randomness in
        ### the encrypted packet changes the md5 sum, we just don't
        ### want the exact same encrypted packet to be replayed).
        my $md5sum = md5_base64($decrypted_msg);

        if (defined $md5_msg_store{$md5sum}) {
            ### Bad!  Just return.
            &logr('[-]', "attempted message replay from: $src_ip", 1);
            return;
        }

        ### store the md5 sum in memory and (optionally) in the
        ### disk cache
        $md5_msg_store{$md5sum} = '';

        &diskwrite_md5_sum($md5sum)
            if $config{'ENABLE_MD5_PERSISTENCE'} eq 'Y';

        ### see if we have a valid message
        my $msg_href = &pcap_validate_msg($decrypted_msg);

        unless ($msg_href) {
            print STDERR "[-] Shared key mis-match or broken message ",
                "checksum for SOURCE $access_vars_href->{'SOURCE'}\n"
                if $debug;
            next NUM;
        }

        print STDERR "[+] Packet fields:\n",
            "        Random data: $msg_href->{'random_number'}\n",
            "        Username:    $msg_href->{'username'}\n",
            "        Remote time: $msg_href->{'remote_time'}\n",
            "        Remote ver:  $msg_href->{'remote_version'}\n",
            "        Action type: $msg_href->{'action_type'}\n",
            "        Action:      $msg_href->{'action'}\n",
            "        MD5 sum:     $msg_href->{'md5sum'}\n" if $debug;

        my $server_auth_type = '';
        my $server_auth_crypt_pw = '';
        if ($msg_href->{'server_auth'}) {
            if ($msg_href->{'server_auth'} =~ /^\s*(\w+),(.*)/) {
                $server_auth_type = lc($1);
                $server_auth_crypt_pw = $2;
                if ($debug) {
                    print STDERR "        Server auth: $server_auth_type,";
                    for (my $i=0; $i<length($server_auth_crypt_pw); $i++) {
                        print STDERR '*';
                    }
                    print STDERR "\n";
                }
            }
        }

        if (defined $access_vars_href->{'REQUIRE_USERNAME'}) {
            unless (defined $required_users{$msg_href->{'username'}}) {
                &logr('[-]', "username mismatch from $src_ip, expecting " .
                    "$access_vars_href->{'REQUIRE_USERNAME'}, got " .
                    "$msg_href->{'username'}", 0);
                next NUM;
            }
        }

        if (defined $access_vars_href->{'REQUIRE_AUTH_METHOD'}) {
            if ($server_auth_type
                    eq $access_vars_href->{'REQUIRE_AUTH_METHOD'}) {
                if ($server_auth_type eq 'crypt') {
                    ### check the local UNIX crypt() password associated
                    ### with the user
                    unless (&server_auth_verify_crypt_pw(
                                $msg_href->{'username'},
                                $server_auth_crypt_pw,
                                $access_vars_href->{'SHADOW_FILE'})) {
                        &logr('[-]', "IP: $src_ip failed server-auth UNIX " .
                            "crypt() password test", 0);
                        next NUM;
                    }
                }
            } else {
                &logr('[-]', "required server-auth method " .
                    "\"$access_vars_href->{'REQUIRE_AUTH_METHOD'}\" " .
                    "not supplied by $src_ip", 0);
                next NUM;
            }
        }

        ### all criteria met; grant access or execute command
        if ($decrypt_algo eq 'GPG') {
            if (defined $access_vars_href->{'GPG_REMOTE_ID'}) {
                &logr('[+]', "received valid $decrypt_algo encrypted packet " .
                    "(signed with required key ID: $gpg_sign_id) from: " .
                    "$src_ip, remote user: $msg_href->{'username'}", 0);
            } else {
                &logr('[+]', "received valid $decrypt_algo encrypted packet " .
                    "from: $src_ip, remote user: $msg_href->{'username'}", 0);
            }
        } else {
            &logr('[+]', "received valid $decrypt_algo encrypted " .
                "packet from: $src_ip, remote user: $msg_href->{'username'}",
                0);
        }

        if ($msg_href->{'action_type'} == $access_mode) {
            if (not $access_vars_href->{'DISABLE_FW_ACCESS'}) {
                if (not $access_vars_href->{'PERMIT_CLIENT_PORTS'}) {

                    ### we don't allow the client to influence which ports
                    ### are opened; only those that are already defined in
                    ### OPEN_PORTS will be opened
                    if ($msg_href->{'action'} =~ /($ip_re)/) {
                        my $allow_ip = $1;

                        $allow_ip = $src_ip if $allow_ip eq '0.0.0.0';

                        &grant_access($allow_ip, '', $access_vars_href);
                    }
                } else {
                    if ($msg_href->{'action'}
                            =~ /($ip_re),(tcp|udp|icmp),(\d+)/i) {
                        ### single port access format (e.g. tcp,22)
                        my $allow_ip        = $1;
                        my $dec_allow_port  = $2;
                        my $dec_allow_proto = $3;

                        $allow_ip = $src_ip if $allow_ip eq '0.0.0.0';

                        $access_vars_href->{'OPEN_PORTS'}
                            ->{$dec_allow_proto}->{$dec_allow_port} = '';

                        &grant_access($allow_ip, '', $access_vars_href);

                    } elsif ($msg_href->{'action'}
                             =~ /($ip_re),none,0/) {
                        my $allow_ip   = $1;
                        $allow_ip = $src_ip if $allow_ip eq '0.0.0.0';

                        &grant_access($allow_ip, '', $access_vars_href);

                    } elsif ($msg_href->{'action'}
                             =~ /($ip_re),(\S+)/) {
                        ### multi-port access format (-A was specified by
                        ### the client)
                        my $allow_ip   = $1;
                        my $access_str = $2;

                        $allow_ip = $src_ip if $allow_ip eq '0.0.0.0';
                        my @dec_allow_ports = split /,/, $access_str;

                        for my $port_str (@dec_allow_ports) {
                            if ($port_str =~ m|(\D+)/(\d+)|) {
                                my $proto = lc($1);
                                my $port  = $2;

                                next unless ($proto eq 'tcp'
                                    or $proto eq 'udp'
                                    or $proto eq 'icmp');
                                $port = 0 if $proto eq 'icmp';
                                $access_vars_href->{'OPEN_PORTS'}
                                    ->{$proto}->{$port} = '';
                            }
                        }
                        &grant_access($allow_ip, '', $access_vars_href);
                    }
                }
            } else {
                &logr('[-]', "received fw access request from $src_ip, " .
                    "but DISABLE_FW_ACCESS is set to a true value", 0);
            }
        } elsif ($msg_href->{'action_type'} == $command_mode) {
            if ($access_vars_href->{'ENABLE_CMD_EXEC'}) {
                my $regex_match = 1;
                if (defined $access_vars_href->{'CMD_REGEX'}) {
                    $regex_match = 0 unless $msg_href->{'action'}
                        =~ /$access_vars_href->{'CMD_REGEX'}/;
                }
                if ($regex_match) {
                    ### execute the command
                    &logr('[+]',
                        qq|executing command "$msg_href->{'action'}" | .
                        "for $src_ip", 1);
                    &exec_command($msg_href->{'action'});
                } else {
                    &logr('[-]',
                        qq|received command "$msg_href->{'action'}" | .
                            "from $src_ip but CMD_REGEX did not " .
                            "match $src_ip", 1);
                }
            } else {
                &logr('[-]',
                    "received command \"$msg_href->{'action'}\" " .
                        "but command mode not enabled for $src_ip", 1);
            }
        }
    }
    return;
}

sub server_auth_verify_crypt_pw() {
    my ($username, $pw, $shadow_file) = @_;

    unless (-e $shadow_file) {
        &logr('[-]', "shadow file $shadow_file does not exist", 0);
        return 0;
    }

    my $shadow_hash = '';
    open S, "< $shadow_file" or die "[*] Could not open $shadow_file: $!";
    while (<S>) {
        my $line = $_;
        if ($line =~ /^\s*$username:(\S+?):/) {
            $shadow_hash = $1;
        }
    }
    close S;

    ### mbr:$1$nrU****************************:13108:0:99999:7:::
    unless ($shadow_hash) {
        &logr('[-]', "could not get password entry for $username " .
            "from /etc/shadow", 0);
        return 0;
    }

    return 1 if (crypt($pw, $shadow_hash) eq $shadow_hash);
    return 0;
}

sub knock_loop() {
    print STDERR "[+] Opening $config{'FW_DATA_FILE'}, and entering main loop.\n"
        if $debug;

    ### main server loop
    open FWLOG, $config{'FW_DATA_FILE'} or die $!;
    for (;;) {
        my @fw_pkts = <FWLOG>;
        if (@fw_pkts and ($os_fprint_only or $skipped_first_loop)) {
            &process_pkts(\@fw_pkts);
        }

        @fw_pkts = ();
        $skipped_first_loop = 1 unless $skipped_first_loop;

        ### always check to see if we need to timeout knock sequences
        ### that exceed the KNOCK_INTERVAL
        &timeout_invalid_sequences();

        ### always check to see if we need to timeout access for IPs
        &timeout_access();

        if ($die_msg) {
            open D, ">> $config{'FWKNOP_DIR'}/fwknopd.die" or
                die "[*] Could not open $config{'FWKNOP_DIR'}/fwknopd.die: $!";
            print D scalar localtime(), " $die_msg";
            close D;
            $die_msg = '';
        }

        if ($warn_msg) {
            open D, ">> $config{'FWKNOP_DIR'}/fwknopd.warn" or
                die "[*] Could not open $config{'FWKNOP_DIR'}/fwknopd.warn: $!";
            print D scalar localtime(), " $warn_msg";
            close D;
            $warn_msg = '';
        }

        ### clearerr() on the FWLOG filehandle to be ready for new packets
        FWLOG->clearerr();

        sleep $config{'SLEEP_INTERVAL'};
    }
    close FWLOG;
    return;
}


sub pcap_validate_msg() {
    my $msg = shift;

    my %msg = ();
    my $md5sum = '';
    my $server_auth = '';
    my @fields = split /:/, $msg;

    return '' unless @fields;

    my $random_number  = $fields[0] || return '';
    my $username       = $fields[1] || return '';
    my $remote_time    = $fields[2] || return '';
    my $remote_version = $fields[3] || return '';
    my $action_type    = $fields[4];
    my $action         = $fields[5] || return '';
    $md5sum            = $fields[6] || return '';
    if ($remote_version =~ /0\.9\.(\d+)/) {
        my $minor_ver_num = $1;
        if ($minor_ver_num > 2 and $#fields > 6) {
            $server_auth = $fields[7] || '';
        }
    }

    return '' unless $action_type == $command_mode
        or $action_type == $access_mode;

    %msg = (
        'random_number'  => $random_number,
        'username'       => $username,
        'remote_time'    => $remote_time,
        'remote_version' => $remote_version,
        'action_type'    => $action_type,
        'action'         => $action,
        'md5sum'         => $md5sum,
    );

    if ($server_auth) {
        $msg{'server_auth'} = $server_auth;
    } else {
        $msg{'server_auth'} = '';
    }

    print STDERR Dumper \%msg if $debug and $verbose;

    ### validate message
    if (&check_md5sum(\%msg)) {
        $msg{'username'}    = decode_base64($msg{'username'});
        $msg{'action'}      = decode_base64($msg{'action'});
        $msg{'server_auth'} = decode_base64($msg{'server_auth'});

        if ($debug) {
            print STDERR "[+] Decoded message: $msg{'random_number'}:",
                "$msg{'username'}:$msg{'remote_time'}:",
                "$msg{'remote_version'}:$msg{'action_type'}:",
                "$msg{'action'}:$msg{'md5sum'}";
            if ($msg{'server_auth'} and $msg{'server_auth'} =~ /^\s*(\w+),(.*)/) {
                print STDERR ":$1,";
                for (my $i=0; $i<length($2); $i++) {
                    print STDERR "*";
                }
                print STDERR "\n";
            } else {
                print STDERR "\n";
            }
        }
        return \%msg;
    }
    return '';
}

sub check_md5sum() {
    my $msg_href = shift;

    my $md5sum = $msg_href->{'md5sum'};

    my $data_str = '';
    for my $key qw(
        random_number
        username
        remote_time
        remote_version
        action_type
        action
    ) {
        $data_str .= $msg_href->{$key} . ':';
    }

    $data_str =~ s/:$//;

    if ($msg_href->{'server_auth'}) {
        $data_str .= ':' . $msg_href->{'server_auth'};
    }

    return 1 if $md5sum eq md5_base64($data_str);
    return 0;
}

sub get_pcap_obj() {

    my $pcap_t  = '';
    my $filter  = '';
    my $err     = '';
    my $netmask = '';
    my $address = '';

    if ($config{'AUTH_MODE'} eq 'FILE_PCAP'
            or $config{'AUTH_MODE'} eq 'ULOG_PCAP') {

        unless (-e $config{'PCAP_PKT_FILE'}) {
            &pcap_file_exists_loop();
        }

        unless (-s $config{'PCAP_PKT_FILE'} > 0) {
            ### required since we cannot use Net::Pcap::open_offline()
            ### to open a zero-size pcap file.
            &pcap_nonzero_size_loop();
        }

        print STDERR "[+] Acquiring packet data from file: ",
            "$config{'PCAP_PKT_FILE'}\n" if $debug;

        $pcap_t = Net::Pcap::open_offline($config{'PCAP_PKT_FILE'}, \$err)
            or die "[*] Could not open $config{'PCAP_PKT_FILE'}: $err";