1Pcap(3) User Contributed Perl Documentation Pcap(3)
2
6 Net::Pcap - Interface to pcap(3) LBL packet capture library
7
9 Version 0.16
10
12 use Net::Pcap;
13 my $err = '';
15 my $dev = pcap_lookupdev(\$err); # find a device
16 # open the device for live listening
18 my $pcap = pcap_open_live($dev, 1024, 1, 0, \$err);
19 # loop over next 10 packets
21 pcap_loop($pcap, 10, \&process_packet, "just for the demo");
22 # close the device
24 pcap_close($pcap);
25 sub process_packet {
27 my($user_data, $header, $packet) = @_;
28 # do something ...
29 }
30
32 "Net::Pcap" is a Perl binding to the LBL pcap(3) library. The README
33 for libpcap describes itself as:
34 "a system-independent interface for user-level packet capture.
36 libpcap provides a portable framework for low-level network
37 monitoring. Applications include network statistics collection,
38 security monitoring, network debugging, etc."
39
41 "Net::Pcap" supports the following "Exporter" tags:
42 · ":bpf" exports a few BPF related constants:
44 BPF_ALIGNMENT BPF_MAJOR_VERSION BPF_MAXBUFSIZE BPF_MAXINSNS
46 BPF_MEMWORDS BPF_MINBUFSIZE BPF_MINOR_VERSION BPF_RELEASE
47 · ":datalink" exports the data link types macros:
49 DLT_AIRONET_HEADER DLT_APPLE_IP_OVER_IEEE1394 DLT_ARCNET
51 DLT_ARCNET_LINUX DLT_ATM_CLIP DLT_ATM_RFC1483 DLT_AURORA DLT_AX25
52 DLT_CHAOS DLT_CHDLC DLT_CISCO_IOS DLT_C_HDLC DLT_DOCSIS DLT_ECONET
53 DLT_EN10MB DLT_EN3MB DLT_ENC DLT_FDDI DLT_FRELAY DLT_HHDLC
54 DLT_IBM_SN DLT_IBM_SP DLT_IEEE802 DLT_IEEE802_11 DLT_IEEE802_11_RADIO
55 DLT_IEEE802_11_RADIO_AVS DLT_IPFILTER DLT_IP_OVER_FC DLT_JUNIPER_ATM1
56 DLT_JUNIPER_ATM2 DLT_JUNIPER_ES DLT_JUNIPER_GGSN DLT_JUNIPER_MFR
57 DLT_JUNIPER_MLFR DLT_JUNIPER_MLPPP DLT_JUNIPER_MONITOR DLT_JUNIPER_SERVICES
58 DLT_LINUX_IRDA DLT_LINUX_SLL DLT_LOOP DLT_LTALK DLT_NULL DLT_OLD_PFLOG
59 DLT_PCI_EXP DLT_PFLOG DLT_PFSYNC DLT_PPP DLT_PPP_BSDOS DLT_PPP_ETHER
60 DLT_PPP_SERIAL DLT_PRISM_HEADER DLT_PRONET DLT_RAW DLT_RIO DLT_SLIP
61 DLT_SLIP_BSDOS DLT_SUNATM DLT_SYMANTEC_FIREWALL DLT_TZSP DLT_USER0
62 DLT_USER1 DLT_USER2 DLT_USER3 DLT_USER4 DLT_USER5 DLT_USER6 DLT_USER7
63 DLT_USER8 DLT_USER9 DLT_USER10 DLT_USER11 DLT_USER12 DLT_USER13
64 DLT_USER14 DLT_USER15
65 · ":pcap" exports the following "pcap" constants:
67 PCAP_ERRBUF_SIZE PCAP_IF_LOOPBACK
69 PCAP_VERSION_MAJOR PCAP_VERSION_MINOR
70 · ":mode" exports the following constants:
72 MODE_CAPT MODE_MON MODE_STAT
74 · ":openflag" exports the following constants:
76 OPENFLAG_PROMISCUOUS OPENFLAG_DATATX_UDP OPENFLAG_NOCAPTURE_RPCAP
78 · ":source" exports the following constants:
80 PCAP_SRC_FILE PCAP_SRC_IFLOCAL PCAP_SRC_IFREMOTE
82 · ":sample" exports the following constants:
84 PCAP_SAMP_NOSAMP PCAP_SAMP_1_EVERY_N PCAP_SAMP_FIRST_AFTER_N_MS
86 · ":rpcap" exports the following constants:
88 RMTAUTH_NULL RMTAUTH_PWD
90 · ":functions" exports the function names with the same names as the
92 C library, so you can write "pcap_lookupdev()" instead of
93 "Net::Pcap::lookupdev()" for example. This should also ease porting
94 C programs to Perl.
95 It also exports short names of the functions (without the "pcap_"
97 prefix) for those which would not cause a clash with an already
98 defined name. Namely, the following functions are not available in
99 short form: "open()", "close()", "next()", "dump()", "file()",
100 "fileno()". Using these short names is now discouraged, and may be
101 removed in the future.
102 The symbols from the ":datalink" and ":pcap" tags are exported by
104 default.
105
107 All functions defined by "Net::Pcap" are direct mappings to the libpcap
108 functions. Consult the pcap(3) documentation and source code for more
109 information.
110 Arguments that change a parameter, for example "pcap_lookupdev()", are
112 passed that parameter as a reference. This is to retain compatibility
113 with previous versions of "Net::Pcap".
114 Lookup functions
116 pcap_lookupdev(\$err)
117 Returns the name of a network device that can be used with
118 "pcap_open_live()" function. On error, the $err parameter is
119 filled with an appropriate error message else it is undefined.
120 Example
122 $dev = pcap_lookupdev();
124 pcap_findalldevs(\%devinfo, \$err)
126 Returns a list of all network device names that can be used with
127 "pcap_open_live()" function. On error, the $err parameter is
128 filled with an appropriate error message else it is undefined.
129 Example
131 @devs = pcap_findalldevs(\%devinfo, \$err);
133 for my $dev (@devs) {
134 print "$dev : $devinfo{$dev}\n"
135 }
136 Note
138 For backward compatibility reasons, this function can also be
139 called using the following signatures:
140 @devs = pcap_findalldevs(\$err);
142 @devs = pcap_findalldevs(\$err, \%devinfo);
144 The first form was introduced by Marco Carnut in "Net::Pcap"
146 version 0.05 and kept intact in versions 0.06 and 0.07. The
147 second form was introduced by Jean-Louis Morel for the Windows
148 only, ActivePerl port of "Net::Pcap", in versions 0.04.01 and
149 0.04.02.
150 The new syntax has been introduced for consistency with the
152 rest of the Perl API and the C API of libpcap(3), where $err is
153 always the last argument.
154 pcap_lookupnet($dev, \$net, \$mask, \$err)
156 Determine the network number and netmask for the device specified
157 in $dev. The function returns 0 on success and sets the $net and
158 $mask parameters with values. On failure it returns -1 and the
159 $err parameter is filled with an appropriate error message.
160 Packet capture functions
162 pcap_open_live($dev, $snaplen, $promisc, $to_ms, \$err)
163 Returns a packet capture descriptor for looking at packets on the
164 network. The $dev parameter specifies which network interface to
165 capture packets from. The $snaplen and $promisc parameters specify
166 the maximum number of bytes to capture from each packet, and
167 whether to put the interface into promiscuous mode, respectively.
168 The $to_ms parameter specifies a read timeout in milliseconds. The
169 packet descriptor will be undefined if an error occurs, and the
170 $err parameter will be set with an appropriate error message.
171 Example
173 $dev = pcap_lookupdev();
175 $pcap = pcap_open_live($dev, 1024, 1, 0, \$err)
176 or die "Can't open device $dev: $err\n";
177 pcap_open_dead($linktype, $snaplen)
179 Creates and returns a new packet descriptor to use when calling the
180 other functions in "libpcap". It is typically used when just using
181 "libpcap" for compiling BPF code.
182 Example
184 $pcap = pcap_open_dead(0, 1024);
186 pcap_open_offline($filename, \$err)
188 Return a packet capture descriptor to read from a previously
189 created "savefile". The returned descriptor is undefined if there
190 was an error and in this case the $err parameter will be filled.
191 Savefiles are created using the "pcap_dump_*" commands.
192 Example
194 $pcap = pcap_open_offline($dump, \$err)
196 or die "Can't read '$dump': $err\n";
197 pcap_loop($pcap, $count, \&callback, $user_data)
199 Read $count packets from the packet capture descriptor $pcap and
200 call the perl function &callback with an argument of $user_data.
201 If $count is negative, then the function loops forever or until an
202 error occurs. Returns 0 if $count is exhausted, -1 on error, and -2
203 if the loop terminated due to a call to pcap_breakloop() before any
204 packets were processed.
205 The callback function is also passed packet header information and
207 packet data like so:
208 sub process_packet {
210 my($user_data, $header, $packet) = @_;
211 ...
213 }
214 The header information is a reference to a hash containing the
216 following fields.
217 · "len" - the total length of the packet.
219 · "caplen" - the actual captured length of the packet data. This
221 corresponds to the snapshot length parameter passed to
222 "open_live()".
223 · "tv_sec" - seconds value of the packet timestamp.
225 · "tv_usec" - microseconds value of the packet timestamp.
227 Example
229 pcap_loop($pcap, 10, \&process_packet, "user data");
231 sub process_packet {
233 my($user_data, $header, $packet) = @_;
234 # ...
235 }
236 pcap_breakloop($pcap)
238 Sets a flag that will force "pcap_dispatch()" or "pcap_loop()" to
239 return rather than looping; they will return the number of packets
240 that have been processed so far, or -2 if no packets have been
241 processed so far.
242 This routine is safe to use inside a signal handler on UNIX or a
244 console control handler on Windows, as it merely sets a flag that
245 is checked within the loop.
246 Please see the section on "pcap_breakloop()" in pcap(3) for more
248 information.
249 pcap_close($pcap)
251 Close the packet capture device associated with the descriptor
252 $pcap.
253 pcap_dispatch($pcap, $count, \&callback, $user_data)
255 Collect $count packets and process them with callback function
256 &callback. if $count is -1, all packets currently buffered are
257 processed. If $count is 0, process all packets until an error
258 occurs.
259 pcap_next($pcap, \%header)
261 Return the next available packet on the interface associated with
262 packet descriptor $pcap. Into the %header hash is stored the
263 received packet header. If not packet is available, the return
264 value and header is undefined.
265 pcap_next_ex($pcap, \%header, \$packet)
267 Reads the next available packet on the interface associated with
268 packet descriptor $pcap, stores its header in "\%header" and its
269 data in "\$packet" and returns a success/failure indication:
270 · 1 means that the packet was read without problems;
272 · 0 means that packets are being read from a live capture, and
274 the timeout expired;
275 · "-1" means that an error occurred while reading the packet;
277 · "-2" packets are being read from a dump file, and there are no
279 more packets to read from the savefile.
280 pcap_compile($pcap, \$filter, $filter_str, $optimize, $netmask)
282 Compile the filter string contained in $filter_str and store it in
283 $filter. A description of the filter language can be found in the
284 libpcap source code, or the manual page for tcpdump(8) . The
285 filter is optimized if the $optimize variable is true. The netmask
286 of the network device must be specified in the $netmask parameter.
287 The function returns 0 if the compilation was successful, or -1 if
288 there was a problem.
289 pcap_compile_nopcap($snaplen, $linktype, \$filter, $filter_str,
291 $optimize, $netmask)
292 Similar to "compile()" except that instead of passing a $pcap
293 descriptor, one passes $snaplen and $linktype directly. Returns -1
294 if there was an error, but the error message is not available.
295 pcap_setfilter($pcap, $filter)
297 Associate the compiled filter stored in $filter with the packet
298 capture descriptor $pcap.
299 pcap_freecode($filter)
301 Used to free the allocated memory used by a compiled filter, as
302 created by "pcap_compile()".
303 pcap_setnonblock($pcap, $mode, \$err)
305 Set the non-blocking mode of a live capture descriptor, depending
306 on the value of $mode (zero to activate and non-zero to
307 deactivate). It has no effect on offline descriptors. If there is
308 an error, it returns -1 and sets $err.
309 In non-blocking mode, an attempt to read from the capture
311 descriptor with "pcap_dispatch()" will, if no packets are currently
312 available to be read, return 0 immediately rather than blocking
313 waiting for packets to arrive. "pcap_loop()" and "pcap_next()"
314 will not work in non-blocking mode.
315 pcap_getnonblock($pcap, \$err)
317 Returns the non-blocking state of the capture descriptor $pcap.
318 Always returns 0 on savefiles. If there is an error, it returns -1
319 and sets $err.
320 Savefile commands
322 pcap_dump_open($pcap, $filename)
323 Open a savefile for writing and return a descriptor for doing so.
324 If $filename is "-" data is written to standard output. On error,
325 the return value is undefined and "pcap_geterr()" can be used to
326 retrieve the error text.
327 pcap_dump($dumper, \%header, $packet)
329 Dump the packet described by header %header and packet data $packet
330 to the savefile associated with $dumper. The packet header has the
331 same format as that passed to the "pcap_loop()" callback.
332 Example
334 my $dump_file = 'network.dmp';
336 my $dev = pcap_lookupdev();
337 my $pcap = pcap_open_live($dev, 1024, 1, 0, \$err);
338 my $dumper = pcap_dump_open($pcap, $dump_file);
340 pcap_loop($pcap, 10, \&process_packet, '');
341 pcap_dump_close($dumper);
342 sub process_packet {
344 my($user_data, $header, $packet) = @_;
345 pcap_dump($dumper, $header, $packet);
346 }
347 pcap_dump_file($dumper)
349 Returns the filehandle associated with a savefile opened with
350 "pcap_dump_open()".
351 pcap_dump_flush($dumper)
353 Flushes the output buffer to the corresponding save file, so that
354 any packets written with "pcap_dump()" but not yet written to the
355 save file will be written. Returns -1 on error, 0 on success.
356 pcap_dump_close($dumper)
358 Close the savefile associated with the descriptor $dumper.
359 Status functions
361 pcap_datalink($pcap)
362 Returns the link layer type associated with the given pcap
363 descriptor.
364 Example
366 $linktype = pcap_datalink($pcap);
368 pcap_set_datalink($pcap, $linktype)
370 Sets the data link type of the given pcap descriptor to the type
371 specified by $linktype. Returns -1 on failure.
372 pcap_datalink_name_to_val($name)
374 Translates a data link type name, which is a "DLT_" name with the
375 "DLT_" part removed, to the corresponding data link type value. The
376 translation is case-insensitive. Returns -1 on failure.
377 Example
379 $linktype = pcap_datalink_name_to_val('LTalk'); # returns DLT_LTALK
381 pcap_datalink_val_to_name($linktype)
383 Translates a data link type value to the corresponding data link
384 type name.
385 Example
387 $name = pcap_datalink_val_to_name(DLT_LTALK); # returns 'LTALK'
389 pcap_datalink_val_to_description($linktype)
391 Translates a data link type value to a short description of that
392 data link type.
393 Example
395 $descr = pcap_datalink_val_to_description(DLT_LTALK); # returns 'Localtalk'
397 pcap_snapshot($pcap)
399 Returns the snapshot length (snaplen) specified in the call to
400 "pcap_open_live()".
401 pcap_is_swapped($pcap)
403 This function returns true if the endianness of the currently open
404 savefile is different from the endianness of the machine.
405 pcap_major_version($pcap)
407 Return the major version number of the pcap library used to write
408 the currently open savefile.
409 pcap_minor_version($pcap)
411 Return the minor version of the pcap library used to write the
412 currently open savefile.
413 pcap_stats($pcap, \%stats)
415 Returns a hash containing information about the status of packet
416 capture device $pcap. The hash contains the following fields.
417 This function is supported only on live captures, not on savefiles;
419 no statistics are stored in savefiles, so no statistics are
420 available when reading from a savefile.
421 · "ps_recv" - the number of packets received by the packet
423 capture software.
424 · "ps_drop" - the number of packets dropped by the packet capture
426 software.
427 · "ps_ifdrop" - the number of packets dropped by the network
429 interface.
430 pcap_file($pcap)
432 Returns the filehandle associated with a savefile opened with
433 "pcap_open_offline()" or "undef" if the device was opened with
434 "pcap_open_live()".
435 pcap_fileno($pcap)
437 Returns the file number of the network device opened with
438 "pcap_open_live()".
439 pcap_get_selectable_fd($pcap)
441 Returns, on Unix, a file descriptor number for a file descriptor on
442 which one can do a "select()" or "poll()" to wait for it to be
443 possible to read packets without blocking, if such a descriptor
444 exists, or -1, if no such descriptor exists. Some network devices
445 opened with "pcap_open_live()" do not support "select()" or
446 "poll()", so -1 is returned for those devices. See pcap(3) for
447 more details.
448 Error handling
450 pcap_geterr($pcap)
451 Returns an error message for the last error associated with the
452 packet capture device $pcap.
453 pcap_strerror($errno)
455 Returns a string describing error number $errno.
456 pcap_perror($pcap, $prefix)
458 Prints the text of the last error associated with descriptor $pcap
459 on standard error, prefixed by $prefix.
460 Information
462 pcap_lib_version()
463 Returns the name and version of the "pcap" library the module was
464 linked against.
465 WinPcap specific functions
467 The following functions are only available with WinPcap, the Win32 port
468 of the Pcap library. If a called function is not available, it will
469 cleanly "croak()".
470 pcap_createsrcstr(\$source, $type, $host, $port, $name, \$err)
472 Accepts a set of strings (host name, port, ...), and stores the
473 complete source string according to the new format (e.g.
474 "rpcap://1.2.3.4/eth0") in $source.
475 This function is provided in order to help the user creating the
477 source string according to the new format. An unique source string
478 is used in order to make easy for old applications to use the
479 remote facilities. Think about tcpdump(1), for example, which has
480 only one way to specify the interface on which the capture has to
481 be started. However, GUI-based programs can find more useful to
482 specify hostname, port and interface name separately. In that case,
483 they can use this function to create the source string before
484 passing it to the "pcap_open()" function.
485 Returns 0 if everything is fine, -1 if some errors occurred. The
487 string containing the complete source is returned in the $source
488 variable.
489 pcap_parsesrcstr($source, \$type, \$host, \$port, \$name, \$err)
491 Parse the source string and stores the pieces in which the source
492 can be split in the corresponding variables.
493 This call is the other way round of "pcap_createsrcstr()". It
495 accepts a null-terminated string and it returns the parameters
496 related to the source. This includes:
497 · the type of the source (file, WinPcap on a remote adapter,
499 WinPcap on local adapter), which is determined by the source
500 prefix ("PCAP_SRC_IF_STRING" and so on);
501 · the host on which the capture has to be started (only for
503 remote captures);
504 · the raw name of the source (file name, name of the remote
506 adapter, name of the local adapter), without the source prefix.
507 The string returned does not include the type of the source
508 itself (i.e. the string returned does not include "file://" or
509 "rpcap://" or such).
510 The user can omit some parameters in case it is not interested in
512 them.
513 Returns 0 if everything is fine, -1 if some errors occurred. The
515 requested values (host name, network port, type of the source) are
516 returned into the proper variables passed by reference.
517 pcap_open($source, $snaplen, $flags, $read_timeout, \$auth, \$err)
519 Open a generic source in order to capture / send (WinPcap only)
520 traffic.
521 The "pcap_open()" replaces all the "pcap_open_xxx()" functions with
523 a single call.
524 This function hides the differences between the different
526 "pcap_open_xxx()" functions so that the programmer does not have to
527 manage different opening function. In this way, the true "open()"
528 function is decided according to the source type, which is included
529 into the source string (in the form of source prefix).
530 Returns a pointer to a pcap descriptor which can be used as a
532 parameter to the following calls ("compile()" and so on) and that
533 specifies an opened WinPcap session. In case of problems, it
534 returns "undef" and the $err variable keeps the error message.
535 pcap_setbuff($pcap, $dim)
537 Sets the size of the kernel buffer associated with an adapter.
538 $dim specifies the size of the buffer in bytes. The return value
539 is 0 when the call succeeds, -1 otherwise.
540 If an old buffer was already created with a previous call to
542 "setbuff()", it is deleted and its content is discarded.
543 "open_live()" creates a 1 MB buffer by default.
544 pcap_setmode($pcap, $mode)
546 Sets the working mode of the interface $pcap to $mode. Valid
547 values for $mode are "MODE_CAPT" (default capture mode) and
548 "MODE_STAT" (statistical mode).
549 pcap_setmintocopy($pcap_t, $size)
551 Changes the minimum amount of data in the kernel buffer that causes
552 a read from the application to return (unless the timeout expires).
553 pcap_getevent($pcap)
555 Returns the "Win32::Event" object associated with the interface
556 $pcap. Can be used to wait until the driver's buffer contains some
557 data without performing a read. See Win32::Event.
558 pcap_sendpacket($pcap, $packet)
560 Send a raw packet to the network. $pcap is the interface that will
561 be used to send the packet, $packet contains the data of the packet
562 to send (including the various protocol headers). The MAC CRC
563 doesn't need to be included, because it is transparently calculated
564 and added by the network interface driver. The return value is 0 if
565 the packet is successfully sent, -1 otherwise.
566 pcap_sendqueue_alloc($memsize)
568 This function allocates and returns a send queue, i.e. a buffer
569 containing a set of raw packets that will be transmitted on the
570 network with "sendqueue_transmit()".
571 $memsize is the size, in bytes, of the queue, therefore it
573 determines the maximum amount of data that the queue will contain.
574 This memory is automatically deallocated when the queue ceases to
575 exist.
576 pcap_sendqueue_queue($queue, \%header, $packet)
578 Adds a packet at the end of the send queue pointed by $queue. The
579 packet header %header has the same format as that passed to the
580 "loop()" callback. $ackekt is a buffer with the data of the packet.
581 The %headerr header structure is the same used by WinPcap and
583 libpcap to store the packets in a file, therefore sending a capture
584 file is straightforward. "Raw packet" means that the sending
585 application will have to include the protocol headers, since every
586 packet is sent to the network as is. The CRC of the packets needs
587 not to be calculated, because it will be transparently added by the
588 network interface.
589 pcap_sendqueue_transmit($pcap, $queue, $sync)
591 This function transmits the content of a queue to the wire. $pcapt
592 is the interface on which the packets will be sent, $queue is to a
593 "send_queue" containing the packets to send, $sync determines if
594 the send operation must be synchronized: if it is non-zero, the
595 packets are sent respecting the timestamps, otherwise they are sent
596 as fast as possible.
597 The return value is the amount of bytes actually sent. If it is
599 smaller than the size parameter, an error occurred during the send.
600 The error can be caused by a driver/adapter problem or by an
601 inconsistent/bogus send queue.
602
604 "Net::Pcap" exports by default the names of several constants in order
605 to ease the development of programs. See "EXPORTS" for details about
606 which constants are exported.
607 Here are the descriptions of a few data link types. See pcap(3) for a
609 more complete description and semantics associated with each data link.
610 · "DLT_NULL" - BSD loopback encapsulation
612 · "DLT_EN10MB" - Ethernet (10Mb, 100Mb, 1000Mb, and up)
614 · "DLT_RAW" - raw IP
616 · "DLT_IEEE802" - IEEE 802.5 Token Ring
618 · "DLT_IEEE802_11" - IEEE 802.11 wireless LAN
620 · "DLT_FRELAY" - Frame Relay
622 · "DLT_FDDI" - FDDI
624 · "DLT_SLIP" - Serial Line IP
626 · "DLT_PPP" - PPP (Point-to-point Protocol)
628 · "DLT_PPP_SERIAL" - PPP over serial with HDLC encapsulation
630 · "DLT_PPP_ETHER" - PPP over Ethernet
632 · "DLT_IP_OVER_FC" - RFC 2625 IP-over-Fibre Channel
634 · "DLT_AX25" - Amateur Radio AX.25
636 · "DLT_LINUX_IRDA" - Linux-IrDA
638 · "DLT_LTALK" - Apple LocalTalk
640 · "DLT_APPLE_IP_OVER_IEEE1394" - Apple IP-over-IEEE 1394 (a.k.a.
642 Firewire)
643
645 "arg%d not a scalar ref"
646 "arg%d not a hash ref"
647 "arg%d not a reference"
648 (F) These errors occur if you forgot to give a reference to a
649 function which expect one or more of its arguments to be
650 references.
651
653 The following limitations apply to this version of "Net::Pcap".
654 · At present, only one callback function and user data scalar can be
656 current at any time as they are both stored in global variables.
657
659 Please report any bugs or feature requests to
660 "bug-Net-Pcap@rt.cpan.org", or through the web interface at
661 https://rt.cpan.org/NoAuth/Bugs.html?Dist=Net-Pcap
662 <https://rt.cpan.org/NoAuth/Bugs.html?Dist=Net-Pcap>. I will be
663 notified, and then you'll automatically be notified of progress on your
664 bug as I make changes.
665 Currently known bugs:
667 · the "ps_recv" field is not correctly set; see t/07-stats.t
669 · "pcap_file()" seems to always returns "undef" for live connection
671 and causes segmentation fault for dump files; see t/10-fileno.t
672 · "pcap_fileno()" is documented to return -1 when called on save
674 file, but seems to always return an actual file number. See
675 t/10-fileno.t
676 · "pcap_dump_file()" seems to corrupt something somewhere, and makes
678 scripts dump core. See t/05-dump.t
679
681 See the eg/ and t/ directories of the "Net::Pcap" distribution for
682 examples on using this module.
683
685 Perl Modules
686 Net::Pcap::Reassemble for reassembly of TCP/IP fragments.
687 POE::Component::Pcap for using "Net::Pcap" within POE-based programs.
689 Net::Packet or NetPacket for decoding and creating network packets.
691 Base Libraries
693 pcap(3), tcpdump(8)
694 The source code for the pcap(3) library is available from
696 <http://www.tcpdump.org/>
697 The source code and binary for the Win32 version of the pcap library,
699 WinPcap, is available from <http://www.winpcap.org/>
700 Articles
702 Hacking Linux Exposed: Sniffing with Net::Pcap to stealthily managing
703 iptables rules remotely,
704 <http://www.hackinglinuxexposed.com/articles/20030730.html>
705 PerlMonks node about Net::Pcap, <http://perlmonks.org/?node_id=170648>
707
709 Current maintainer is Sebastien Aperghis-Tramoni (SAPER)
710 <sebastien@aperghis.net> with the help of Jean-Louis Morel (JLMOREL)
711 <jl_morel@bribes.org> for WinPcap support.
712 Previous authors & maintainers:
714 · Marco Carnut (KCARNUT) <kiko@tempest.com.br>
716 · Tim Potter (TIMPOTTER) <tpot@frungy.org>
718 · Bo Adler (BOADLER) <thumper@alumni.caltech.edu>
720 · Peter Lister (PLISTER) <p.lister@cranfield.ac.uk>
722
724 To Paul Johnson for his module "Devel::Cover" and his patience for
725 helping me using it with XS code, which revealed very useful for
726 writing more tests.
727 To the beta-testers: Jean-Louis Morel, Max Maischen, Philippe Bruhat,
729 David Morel, Scott Lanning, Rafael Garcia-Suarez, Karl Y. Pradene.
730
732 Copyright (C) 2005, 2006, 2007, 2008 Sebastien Aperghis-Tramoni. All
733 rights reserved.
734 Copyright (C) 2003 Marco Carnut. All rights reserved.
736 Copyright (C) 1999, 2000 Tim Potter. All rights reserved.
738 Copyright (C) 1998 Bo Adler. All rights reserved.
740 Copyright (C) 1997 Peter Lister. All rights reserved.
742 This program is free software; you can redistribute it and/or modify it
744 under the same terms as Perl itself.
745perl v5.12.0 2008-01-01 Pcap(3)