Another powerful feature of Nsock is the ability to process raw packets with a wrapper to Libpcap. Libpcap provides a framework for user-level packet captures that is platform-independent and very robust. NSE developers that need to receive raw packets or send packets to the IP and Ethernet layer can do so through the Nmap API.
In this section, we will learn about the pcap_open, pcap_register, and pcap_receive methods, which are used to receive raw packets, and ip_open, ip_send, ip_close, ethernet_open, ethernet_send, and ethernet_close, which are used to send raw frames.
The first step to handling raw packets is to open an NSE socket. Import the nmap library and create a regular NSE socket with new_socket. Then invoke the pcap_open method:
local nmap = require "nmap"
…
local socket = nmap.new_socket()
socket:pcap_open("eth0", 64, false, "tcp")The pcap_open method takes the following parameters: