NAME

Net::Inspect::L5::GuessProtocol - tries to find and redirect to appropriate protocol handler

SYNOPSIS

...
my $guess = Net::Inspect::L5::GuessProtocol->new;
$guess->attach($http);
$guess->attach($null);
...
my $tcp = Net::Inspect::L4::TCP->new($guess);

DESCRIPTION

Uses the attached flows to find out, which OSI Layer 7 protocol the data might be in and then gives control to the appropriate protocol handler.

Implements the hooks required for Net::Inspect::L4::TCP. Usually attached to Net::Inspect::L4::TCP and attached flows are usually Net::Inspect::Connection::*.

Methods:

attach(flow)

attaches specified flow, which should provide guess_protocol method

detach(flow)

detaches specified flow

attached

returns list of attached flows

Hooks provided:

new_connection(\%meta)

in($dir,$data,$eof,$time)

forwarded to protocol implementing object if it is already found. Otherwise calls guess_protocol and length($data).

fatal($reason,$time)

forwarded to protocol implementing object

Called hooks:

guess_protocol($guess,$dir,$data,$eof,$time,\%meta)

The flow should return an appropriate Net::Inspect::Connection object if it does implement the protocol. If it does not implement the protocol it should detach itself from the $guess flow using $guess->detach($self) and return (). If it needs more data to decide it should simply return ().

The hook must do it's own buffering of the given data and process them before returning itself as the protocol handler.

The hooks in and fatal gets forwarded to the protocol implementing object once it is found.