[Netexpect-users] Can't run netexpect - receiving error "arp(sha)": variable isn't array

[Eloy Paris]

[Milos, I am sorry for responding here in the list in addition to the 
private message that I just sent you but the answer might be of benefit 
to other users as well.]

On 08/27/2012 03:09 PM, Milos Kostic-Veljkovic wrote:

> Hi,
>
> I have installed netexpect on ubuntu 12 with apt-get, together with
> bunch of other packages. This is a fresh install
>
> Now when I try to run any of the examples, scripts always fail with an
> error.
>
> Example code:
>
> root at ubuntu1:/home/riverbed/Documents# cat arp.nexp
> spawn_network -i eth3 host 22.0.0.21 and {arp[6:2]} == 1
> set mymac 00:11:22:33:44:55
>
>            expect_network {1} {
>                # Received an ARP request, send ARP reply
>
> puts $arp  <---- ADDED THIS ON PURPOSE TO TRY TO PRINT $ARP
> # puts $arp(sip)
>           send_network -o eth3 \
>                    ether(src = $mymac, dst = $arp(sha) )/ \
>                    arp-reply(tha = $arp(sha), tip = $arp(sip), \
>                              sha = $mymac, sip = 22.0.0.21)
>                nexp_continue
>            }
>
>
> And the error is always:
>
> root at ubuntu1:/home/riverbed/Documents# nexp arp.nexp
> \x00\x01\x08\x00\x06\x04\x00\x01\x00\x0c\x29\x77\x04\x27\x16\x00\x00\x01\x00\x00\x00\x00\x00\x00\x16\x00\x00\x15
> (this above is puts $arp output)
>
> error is bellow:
>
> can't read "arp(sha)": variable isn't array

$arp(sha) is what needed to be used before dissection tasks were moved 
to libwireshark, i.e. the Wireshark dissection engine.

Now, an expect_network {} statement will produce the same variable names 
as the field names that Wireshark would produce (those used in Wireshark 
display filters). Therefore, the above send_network should be re-written 
to something like this:

   send_network -o eth3 \
       ether(src = $mymac, dst = ${arp.src.hw_mac})/ \
       arp-reply(tha = ${arp.src.hw_mac}, tip = ${arp.src.proto_ipv4}, \
                 sha = $mymac, sip = 22.0.0.21)

As a troubleshooting/debugging technique you can put the "show 
dissection vars" right after your expect_network command. Here's an 
interactive example:

netexpect> spawn_network -i eth0 arp
netexpect> expect_network 1
netexpect> show dissection vars
arp.hw.size arp.dst.hw_mac frame.time_epoch frame.protocols 
frame.time_relative eth.type vlan eth.dst.eth.lg vlan.cfi arp.src.hw_mac 
arp.proto.type frame.time_delta_displayed frame.ignored frame.len eth 
eth.src.eth.lg arp.hw.type arp.isgratuitous arp.proto.size 
arp.src.proto_ipv4 frame.marked eth.src.eth.addr frame.cap_len 
eth.dst.eth.ig frame arp.opcode _ arp.dst.proto_ipv4 eth.dst.eth.addr 
pdu eth.src.eth.ig vlan.etype frame.number vlan.trailer frame.time_delta 
vlan.priority arp frame.time eth.src vlan.id eth.dst
netexpect> puts "MAC = ${arp.src.hw_mac} type = ${arp.proto.type} IP = 
${arp.dst.proto_ipv4}"
MAC = 00:1d:45:95:66:50 type = 2048 IP = 10.80.35.41

The "info vars" command also shows the variables that were created 
during dissection. For example:

netexpect> info vars
tcl_interactive tcl_version escape_printable frame.number arp.opcode 
vlan.id auto_path errorInfo auto_execs vlan.priority vlan env 
eth.dst.eth.addr frame.cap_len arp.src.proto_ipv4 argc frame.marked 
vlan.etype frame.time_epoch argv0 iface frame.ignored arp.isgratuitous 
verbose multianswers eth.src.eth.addr eth.src auto_index tcl_pkgPath 
tclreadline_library frame.time_relative eth.src.eth.ig tcl_prompt1 
arp.src.hw_mac arp.proto.size tcl_prompt2 _ timeout eth.dst.eth.ig argv 
tcl_rcFileName frame.time arp.dst.hw_mac listener_id arp errorCode 
arp.hw.size pdu vlan.trailer tcl_patchLevel tclreadline_version 
arp.proto.type tcl_platform tcl_library msg arp.dst.proto_ipv4 eth 
eth.dst frame tclreadline_patchLevel eth.src.eth.lg speaker_id 
frame.time_delta_displayed arp.hw.type tsformat frame.len vlan.cfi 
eth.type frame.time_delta eth.dst.eth.lg frame.protocols

I have been trying to clean up the examples shipped in the examples/ 
directory of the netexpect tarball. A few examples probably need to be 
converted, though, and the examples in the wiki probably are very 
outdated and I need to clean them up.

Cheers

Eloy Paris.-
netexpect.org


>      while executing
> "send_network -o eth3  ether(src = $mymac, dst = $arp(sha) )/
>   arp-reply(tha = $arp(sha), tip = $arp(sip),  sha = $mymac, sip =
> 22.0.0.21)"
>      invoked from within
> "expect_network {1} {
>                # Received an ARP request, send ARP reply
>
> puts $arp
> # puts $arp(sip)
>           send_network -o eth3 \
>          ..."
>      (file "arp.nexp" line 4)
>
>
> Thanks for your tips if you could point me to the good direction how to
> fix this
>
> Milos
>
>
> _______________________________________________
> Netexpect-users mailing list
> Netexpect-users at lists.alioth.debian.org
> http://lists.alioth.debian.org/mailman/listinfo/netexpect-users
>