Net::Tshark - Interface for the tshark network capture utility
use Net::Tshark;
# Start the capture process, looking for packets containing HTTP requests and responses
my $tshark = Net::Tshark->new;
$tshark->start(interface => 2, display_filter => 'http');
# Do some stuff that would trigger HTTP requests/responses for 30 s
sleep 30;
# Get any packets captured
$tshark->stop;
my @packets = $tshark->get_packets;
# Extract packet information by accessing each packet like a nested hash
my $src_ip = $packets[0]->{ip}->{src};
my $dst_ip = $packets[0]->{ip}->{dst};
A module that uses the command-line tshark utility to capture packets, parse the output, and format the results as perl hash-like structures.
Returns a newly created Net::Tshark object.
Parameters: interface - network interface to use (1, 2, etc) capture_filter - capture filter, as used by tshark display_filter - display filter, as used by tshark duration - maximum number of seconds to capture packets for promiscuous - set to 0 to disable promiscuous mode (necessary for some WiFi adapters)
Terminates the tshark process, stopping any further packet capture. You may still execute get_packets after the tshark process has terminated.
Returns a true value if the tshark process is running, or a false value if the tshark process is not running.
Retrieves the next available captured packet, or returns undef if no packets are available. Packets are Net::Tshark::Packet objects, which implement much of the same interface as native hashes. Therefore, you can dereference Net::Tshark::Packet objects much as you would nested hashes. In fact, you can even cast a Net::Tshark::Packet object to a real hash:
# Get a packet and access its fields directly
my $packet = $tshark->get_packet;
print "The dst IP is $packet->{ip}->{dst}\n";
# Deep-copy the packet object and store its fields in a native hash
my %packet_hash = %{$packet->hash};
print "The src IP is $packet_hash{ip}->{src}\n";
Retrieves all available captured packets, or returns an empty list if no packets are available.
# Get a list of the source ips of all captured IP packets
my @packets = $tshark->get_packets;
my @src_ips = map { $_->{ip}->{src} } grep { defined $_->{ip} } @packets;
Net::Pcap - Interface to pcap(3) LBL packet capture library
Net::Sharktools - Use Wireshark's packet inspection capabilities in Perl
Zachary Blair, <zblair@cpan.org>
Copyright (C) 2012 by Zachary Blair
This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.8 or, at your option, any later version of Perl 5 you may have available.
