NAME

Net::Analysis::TCPSession - represent a TCP session (with two endpoints)

SYNOPSIS

use Net::Analysis::TCPSession qw(:const);

my $sesh = Net::Analysis::TCPSession->new ();

foreach my $pkt (@packets) {
  my $ret = $sesh->process_packet ($pkt);
  ($ret) || die "broken session: ".$sesh->errstr();
  print " >> $sesh <<\n";

  if      ($ret == PKT_ESTABLISHED_SESSION) {
    print "new session established\n";

  } elsif ($ret == PKT_TERMINATED_SESSION) {
    print "session torn down\n";

  } elsif ($ret == PKT_FLIPPED_DIR) {
    print "monologue generated\n----\n".$sesh->previous_monologue();
  }
}

if ($sesh->has_current_monologue()) {
  print "final monologue\n----\n".$sesh->current_monologue();
}

DESCRIPTION

Processes a packet in the context of an existing TCP session. This is the module that does the bulk of the stream management; SYNs, ACKs, dropping duplicates and storing out-of-sequence packets.

A packet, once placed in order, is considered to do just one of four things:

• establish a new TCP session

• add data to a TCP monologue (data travelling in one direction)

• flip the direction of conversation (thus terminating existing monologue)

• terminate the TCP session

EXPORT

None by default.

SEE ALSO

AUTHOR

Adam B. Worrall, <worrall@cpan.org>

COPYRIGHT AND LICENSE

Copyright (C) 2004 by Adam B. Worrall

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.5 or, at your option, any later version of Perl 5 you may have available.