NAME

Net::Tshark - Interface for the tshark network capture utility

SYNOPSIS

use Net::Tshark;

# Start the capture process, looking for packets containing HTTP requests and responses
my $tshark = Net::Tshark->new;
$tshark->start(interface => 2, display_filter => 'http');

# Do some stuff that would trigger HTTP requests/responses for 30 s
sleep 30;

# Get any packets captured
$tshark->stop;
my @packets = $tshark->get_packets;

# Extract packet information by accessing each packet like a nested hash
my $src_ip = $packets[0]->{ip}->{src};
my $dst_ip = $packets[0]->{ip}->{dst};

DESCRIPTION

A module that uses the command-line tshark utility to capture packets, parse the output, and format the results as perl hash-like structures.

CONSTRUCTOR

$tshark = Net::Tshark->new()

Returns a newly created Net::Tshark object.

METHODS

$tshark->start(%options)

Parameters:
interface      - network interface to use (1, 2, etc)
capture_filter - capture filter, as used by tshark
display_filter - display filter, as used by tshark
duration       - maximum number of seconds to capture packets for
promiscuous    - set to 0 to disable promiscuous mode (necessary for some WiFi adapters)

$tshark->stop

Terminates the tshark process, stopping any further packet capture. You may still execute get_packets after the tshark process has terminated.

$tshark->is_running

Returns a true value if the tshark process is running, or a false value if the tshark process is not running.

$tshark->get_packet

Retrieves the next available captured packet, or returns undef if no packets are available. Packets are Net::Tshark::Packet objects, which implement much of the same interface as native hashes. Therefore, you can dereference Net::Tshark::Packet objects much as you would nested hashes. In fact, you can even cast a Net::Tshark::Packet object to a real hash:

# Get a packet and access its fields directly
my $packet = $tshark->get_packet;
print "The dst IP is $packet->{ip}->{dst}\n";

# Deep-copy the packet object and store its fields in a native hash
my %packet_hash = %{$packet->hash};
print "The src IP is $packet_hash{ip}->{src}\n";

$tshark->get_packets

Retrieves all available captured packets, or returns an empty list if no packets are available.

 # Get a list of the source ips of all captured IP packets
 my @packets = $tshark->get_packets;
 my @src_ips = map { $_->{ip}->{src} } grep { defined $_->{ip} } @packets;

SEE ALSO

Net::Pcap - Interface to pcap(3) LBL packet capture library

Net::Sharktools - Use Wireshark's packet inspection capabilities in Perl

AUTHOR

Zachary Blair, <zblair@cpan.org>

COPYRIGHT AND LICENSE

Copyright (C) 2012 by Zachary Blair

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.8 or, at your option, any later version of Perl 5 you may have available.