HTTP::Sessioniser - Rebuild HTTP sessions from pcap streams
use HTTP::Sessioniser; # This will be called once per HTTP request/response pair sub my_callback { my ($request, $response, $info) = @_; # $request is HTTP::Request # $response is HTTP::Response } my $s = HTTP::Sessioniser->new(); $s->parse_file('/path/to/file.pcap', \&my_callback);
This module extracts HTTP sessions from pcap files with the help of Net::LibNIDS.
It will piece HTTP data back together and return a pair of HTTP::Request and HTTP::Response which correspond to one HTTP 'session'.
HTTP CONNECT sessions are dealt with specially: the first request/response pair will be returned as normal, subsequent requests will be skipped (as they do not contain HTTP requests or responses, only SSL data).
None by default.
my $s = HTTP::Sessioniser->new();
Creates a new object.
$s->parse_file('/path/to/file.pcap', \&callback);
Parses a pcap file using libnids, rebuilding pairs of HTTP::Request and HTTP::Response. These will be passed to the callback function along with a hash of information about the current connection.
$s->ports( [ 80, 443, 8080, 3128 ] ); my @p = $s->ports;
Set or return and array of ports we expect to see HTTP transmission on. The default set of ports is 80, 443, 8080 and 3128.
If you are looking for HTTP on other ports (e.g. proxying or application servers) then use this to set the filter appropriately.
$s->add_port(8000);
Add one port to the filter list.
This module does not support HTTP pipelining. It could be added if I find data which requires it.
HTTP::Parser - used to parse data into HTTP::Request or HTTP::Response objects
David Cannings <david@edeca.net>
Copyright (C) 2010 by David Cannings
To install HTTP::Sessioniser, copy and paste the appropriate command in to your terminal.
cpanm
cpanm HTTP::Sessioniser
CPAN shell
perl -MCPAN -e shell install HTTP::Sessioniser
For more information on module installation, please visit the detailed CPAN module installation guide.