#Http network sniffer driver#
#Http network sniffer code#

The tcp_log callback is passed on to the underlying Sniffer::Connection object and can be used to monitor the TCP connection. The log callback is called whenever the connection makes progress and in other various situations. The response callback is called with the parsed response, the request and the connection object. Currently, the hostname for the absolute URI is constructed from the Host: header. The request will be an instance of HTTP::Request and will have an absolute URI if possible. The request callback is called with the parsed request and the connection object. The file is presumed to contain an ethernet stream of packets. This is convenient to use if you have packet captures from a remote machine or want to test new protocol sniffers. 'Listens' to the packets dumped into a file. Timeout - the read timeout in ms while waiting for packets. A large value led to lost packets in at least one case. The size of this buffer can determine whether you lose packets while processing. Snaplen - size of the Net::Pcap capture buffer If you want to skip netmask detection, for example because your capture device has no IP address, you can pass in the netmask through this option.

#Http network sniffer code#

If you have special configuration options, configure the device to your needs in your code and then pass it in. This skips the detection of the device by name. This is mostly useful for remote debugging of a problematic sequence of connections.ĭevice - a preconfigured Net::Pcap device. The %OPTIONS can be the following options:Ĭapture_file - filename to which the whole capture stream is written, in Net::Pcap format. The DEVICE_NAME parameter is used to determine the device via find_device from Net::Pcap::FindDevice. If you want finer control over what Net::Pcap does, you need to set up Net::Pcap yourself. Listens on the given device for all TCP traffic from and to port 80 and invokes the callbacks as necessary. The optional TIMESTAMP corresponds to the epoch time the packet was captured at. It returns the Sniffer::Connection::HTTP object that handled the packet.

This processes the packet by handing it off to the Sniffer::Connection which handles the reordering of TCP packets. You need to call this method (or one of the other protocol methods) for every packet you wish to handle. Net::PCap will return this kind of packet for most Ethernet network cards. The defaults are TIMEOUT - $sniffer->timeout TIMESTAMP - time() $sniffer->handle_eth_packet ETH $sniffer->live_connections TIMEOUT, TIMESTAMP Will call the handler HANDLER for all connections that have a last_activity before TIMESTAMP - TIMEOUT.Īll parameters are optional and default to: TIMEOUT - $sniffer->timeout $sniffer->stale_connections( TIMEOUT, TIMESTAMP, HANDLER ) This parses a TCP packet and creates the TCP connection to keep track of the packet order and resent packets. $sniffer->find_or_create_connection TCP, %ARGS This will not have the intended effect if the connection is still alive, as it will be recreated as soon as the next packet for it is received. Removes a connection (or a key) from the list of connections. Request => sub ,Įxcept that you will likely do more work than this example.

#Http network sniffer driver#

Sniffer::HTTP - multi-connection sniffer driver SYNOPSIS use Sniffer::HTTP

$sniffer->live_connections TIMEOUT, TIMESTAMP.

$sniffer->stale_connections( TIMEOUT, TIMESTAMP, HANDLER ).

$sniffer->find_or_create_connection TCP, %ARGS.