Net::Tshark - Interface for the tshark network capture utility
use Net::Tshark; # Start the capture process, looking for packets containing HTTP requests and responses my $tshark = Net::Tshark->new; $tshark->start(interface => 2, display_filter => 'http'); # Do some stuff that would trigger HTTP requests/responses for 30 s sleep 30; # Get any packets captured $tshark->stop; my @packets = $tshark->get_packets; # Extract packet information by accessing each packet like a nested hash my $src_ip = $packets[0]->{ip}->{src}; my $dst_ip = $packets[0]->{ip}->{dst};
A module that uses the command-line tshark utility to capture packets, parse the output, and format the results as perl hash-like structures.
Returns a newly created Net::Tshark object.
Net::Tshark
Parameters: interface - network interface to use (1, 2, etc) capture_filter - capture filter, as used by tshark display_filter - display filter, as used by tshark duration - maximum number of seconds to capture packets for promiscuous - set to 0 to disable promiscuous mode (necessary for some WiFi adapters)
Terminates the tshark process, stopping any further packet capture. You may still execute get_packets after the tshark process has terminated.
get_packets
Returns a true value if the tshark process is running, or a false value if the tshark process is not running.
Retrieves the next available captured packet, or returns undef if no packets are available. Packets are Net::Tshark::Packet objects, which implement much of the same interface as native hashes. Therefore, you can dereference Net::Tshark::Packet objects much as you would nested hashes. In fact, you can even cast a Net::Tshark::Packet object to a real hash:
Net::Tshark::Packet
# Get a packet and access its fields directly my $packet = $tshark->get_packet; print "The dst IP is $packet->{ip}->{dst}\n"; # Deep-copy the packet object and store its fields in a native hash my %packet_hash = %{$packet->hash}; print "The src IP is $packet_hash{ip}->{src}\n";
Retrieves all available captured packets, or returns an empty list if no packets are available.
# Get a list of the source ips of all captured IP packets my @packets = $tshark->get_packets; my @src_ips = map { $_->{ip}->{src} } grep { defined $_->{ip} } @packets;
Net::Pcap - Interface to pcap(3) LBL packet capture library
Net::Sharktools - Use Wireshark's packet inspection capabilities in Perl
Zachary Blair, <zblair@cpan.org>
Copyright (C) 2012 by Zachary Blair
This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.8 or, at your option, any later version of Perl 5 you may have available.
To install Net::Tshark, copy and paste the appropriate command in to your terminal.
cpanm
cpanm Net::Tshark
CPAN shell
perl -MCPAN -e shell install Net::Tshark
For more information on module installation, please visit the detailed CPAN module installation guide.