NAME

Net::IMP::SessionLog - analyzer which only logs data

SYNOPSIS

    my $factory = Net::IMP::SessionLog->new_factory(
        dir => '/path/where/the/logs/should/be/stored/',
        format => 'pcap',
    );

DESCRIPTION

Net::IMP::SessionLog implements an analyzer which logs the session data into a file. To be less burden to the connection it will initially return IMP_PREPASS with IMP_MAXOFFSET for both directions, which will cause all data to be forwarded before they get send to the session logger.

For constructing the file name of the session log it needs the following data given within new_factory or new_analyzer:

dir DIR

dir will specify the path, where the session log should be created.

meta HASH

From meta are needed caddr for client ip, cport for client port, saddr for server ip and sport for destination port.

format 'bin'|'pcap'

Specifies the format to use for the logfile.

Default is 'bin', which prefixes each entry in the log file with time and direction, e.g. data can be extracted from the log like this:

    open( my $fh,'<',$logfile );
    while (read($fh,my $buf,13)) {
        my ($time_s,$time_us,$dir,$len) = unpack('NNcN',$buf);
        read($fh,$buf,$len) or die $!;
        print localtime($time_s).".$time_us dir=$dir <<<<\n",
            $buf,
            "\n>>>>>\n",
    }

If the format is 'pcap' it will create data readable with tcpdump, wireshark etc. In this case it needs the Net::PcapWriter module.

AUTHOR

Steffen Ullrich <sullr@cpan.org>

COPYRIGHT

Copyright by Steffen Ullrich.

This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself.