NAME

Net::Tshark::Field - Represents a field in a packet returned by Net::Tshark.

SYNOPSIS

use Net::Tshark;

# Start the capture process, looking for HTTP packets
my $tshark = Net::Tshark->new;
$tshark->start(interface => 2, display_filter => 'http');

# Do some stuff that would trigger HTTP packets for 30 s
...

# Get any packets captured
my @packets = $sniffer->get_packets;

# Extract packet information by accessing each packet like a nested hash
my $src_ip = $packets[0]->{ip}->{src};
my $dst_ip = $packets[0]->{ip}->{dst};

# Find all of the HTTP packets captured
my @http_packets = grep { defined $_->{http} } @packets;

DESCRIPTION

Represents a field within a packet returned by Net::Tshark->get_packet.

METHODS

$tshark->start(%options)

Parameters:
interface      - network interface to use (1, 2, etc)
capture_filter - capture filter, as used by tshark
display_filter - display filter, as used by tshark
duration       - maximum number of seconds to capture packets for

$tshark->stop

Terminates the tshark process, stopping any further packet capture. You may still execute get_packets after the tshark process has terminated.

$tshark->is_running

Returns a true value if the tshark process is running, or a false value if the tshark process is not running.

$tshark->get_packet

Retrieves the next available captured packet, or returns undef if no packets are available. Packets are Net::Tshark::Packet objects, which implement much of the same interface as native hashes. Therefore, you can dereference Net::Tshark::Packet objects much as you would nested hashes. In fact, you can even cast a Net::Tshark::Packet object to a real hash:

# Get a packet and access its fields directly
my $packet = $tshark->get_packet;
print "The dst IP is $packet->{ip}->{dst}\n";

# Deep-copy the packet object and store its fields in a native hash
my %packet_hash = %{$packet->hash};
print "The src IP is $packet_hash{ip}->{src}\n";

$tshark->get_packets

Retrieves all available captured packets, or returns an empty list if no packets are available.

 # Get a list of the source ips of all captured IP packets
 my @packets = $tshark->get_packets;
 my @src_ips = map { $_->{ip}->{src} } grep { defined $_->{ip} } @packets;

SEE ALSO

Net::Pcap - Interface to pcap(3) LBL packet capture library

AUTHOR

Zachary Blair, <zack_blair@hotmail.com>

COPYRIGHT AND LICENSE

Copyright (C) 2012 by Zachary Blair

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.8 or, at your option, any later version of Perl 5 you may have available.