/ 
Net-Nmsg-0.04
River stage zero No dependents
/ Net::Nmsg::Input

NAME

Net::Nmsg::Input - Perl interface for nmsg inputs

SYNOPSIS

use Net::Nmsg::Input;
use Net::Nmsg::Output;

my $in  = Net::Nmsg::Input->open('input.nmsg');
my $out = Net::Nmsg::Output->open('output.nmsg');

my $c = 0;

while (my $msg = $in->read) {
  print "got message $c $msg\n";
  $out->write($msg);
}

# alternatively:

my $cb = sub {
  print "got message $c ", shift, "\n"
  $out->write($msg);
};
$in->loop($cb);

DESCRIPTION

Net::Nmsg::Input is the base class of a set format-specific input classes which provide perl interfaces for the Net::Nmsg::XS::input extension.

CONSTRUCTORS

open(%options)

Creates a new input object. The class of the returned object depends on the apparent format of the input. The resulting object can be treated like an IO handle. The following both work:

while (my $msg = <$in>) {
  # deal with $msg
}

while (my $msg = $in->read()) {
  # deal with $msg
}

Available options:

filter_vendor =item filter_msgtype

Filter incoming messages based on the given vendor/msgtype. Both are required if filtering is desired. Values can either be by name or numeric id.

filter_source

Filter incoming messages based on the given source (nmsg only).

filter_operator

Filter incoming messages based on the given operator (nmsg only).

filter_group

Filter incoming messages based on the given group (nmsg only).

blocking_io

Specify whether or not this input is blocking or not.

bpf

Specify a Berkley Packet Filter (pcap file/interface only)

snaplen

Packet capture size (live interface only)

promisc

Promiscuous mode (live interface only)

open_nmsg($spec, %options)

Opens an input in nmsg format, as specified by file name, file handle, socket specification, or socket handle.

open_pres($spec, %options)

Opens an input in presentation format, as specified by file name or file handle. The 'filter_vendor' and 'filter_msgtype' options are required.

open_pcap($spec, %options)

Opens an input in pcap format, as specified by file name. The 'filter_vendor' and 'filter_msgtype' options are required.

open_iface($spec, %options)

Opens an input in pcap format, as specified by interface name The 'filter_vendor' and 'filter_msgtype' options are required.

ACCESSORS

set_msgtype($vendor, $msgtype)
get_msgtype()
set_filter_source($source)
get_filter_source()
set_filter_operator($operator)
get_filter_operator()
set_filter_group($group)
get_filter_group()
set_blocking_io($bool)
get_blocking_io()
set_bpf($bpf)
get_bpf()
set_snaplen($len)
get_snaplen()
set_promisc($bool)
get_promisc()

METHODS

read()

Returns the next message from this input, if available, as a Net::Nmsg::Msg object.

loop($callback, [$count])

Initiate processing of this input source, passing messages to the given code reference. Callbacks receive a single Net::Nmsg::Msg reference as an argument. An optional parameter count stops the loop after that many messages have been returned via the callback.

SEE ALSO

Net::Nmsg::IO, Net::Nmsg::Output, Net::Nmsg::Msg, nmsgtool(1)

AUTHOR

Matthew Sisk, <sisk@cert.org>

COPYRIGHT AND LICENSE

Copyright (C) 2010 by Carnegie Mellon University

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License, as published by the Free Software Foundation, under the terms pursuant to Version 2, June 1991.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.