view release on metacpan or  search on metacpan

lib/App/RecordStream/Operation/fromtcpdump.pm  view on Meta::CPAN

package App::RecordStream::Operation::fromtcpdump;

our $VERSION = "4.0.25";

use strict;
use warnings;

use base qw(App::RecordStream::Operation);

use App::RecordStream::OptionalRequire qw(NetPacket::Ethernet :ALL);
use App::RecordStream::OptionalRequire qw(NetPacket::IP :ALL);
use App::RecordStream::OptionalRequire qw(NetPacket::TCP :ALL);
use App::RecordStream::OptionalRequire qw(NetPacket::UDP :ALL);
use App::RecordStream::OptionalRequire qw(NetPacket::ARP :ALL);
use App::RecordStream::OptionalRequire qw(Net::Pcap pcap_open_offline pcap_loop pcap_next_ex);
use App::RecordStream::OptionalRequire qw(Net::DNS::Packet);
App::RecordStream::OptionalRequire::require_done();

use Data::Dumper;

# From NetPacket::IP
my $IP_FLAGS = {
  'more_fragments' => IP_FLAG_MOREFRAGS,
  'dont_fragment'  => IP_FLAG_DONTFRAG,
  'congestion'     => IP_FLAG_CONGESTION,
};

# From NetPacket::TCP
my $TCP_FLAGS = {
  FIN => FIN,
  SYN => SYN,
  RST => RST,
  PSH => PSH,
  ACK => ACK,
  URG => URG,
  ECE => ECE,
  CWR => CWR,
};

# From NetPacket::ARP_OPCODES
my $ARP_OPCODES = {
  +ARP_OPCODE_REQUEST  , 'ARP_REQUEST',
  +ARP_OPCODE_REPLY    , 'ARP_REPLY',
  +RARP_OPCODE_REQUEST , 'RARP_REQUEST',
  +RARP_OPCODE_REPLY   , 'RARP_REPLY',
};

my $DEFAULT_SUPPRESSED_FIELDS = [qw(data _frame _parent type)];

sub init {
  my $this = shift;
  my $args = shift;

  my $data = 0;
  my $spec = {
    'data' => \$data,
  };

  $this->parse_options($args, $spec);

  if ( ! @$args ) {
    die "Missing capture file\n";
  }

  $this->{'FILES'} = $args;
  $this->{'DATA'}  = $data;
}

sub wants_input {
  return 0;
}

sub stream_done {
  my $this = shift;

  foreach my $filename ( @{$this->{'FILES'}} ) {
    $this->update_current_filename($filename);
    # TODO: have a connections output rather than packets
    $this->dump_packets($filename);
  }
}

sub dump_packets {
  my $this = shift;