Re: Real time reading of multiple pcap 'instances' at once


go ahead... be a heretic
	PerlMonks

Re: Real time reading of multiple pcap 'instances' at once

by Fletch (Bishop)

on Nov 15, 2008 at 00:24 UTC ( [id://723756]=note: print w/replies, xml )

Need Help??

in reply to Real time reading of multiple pcap 'instances' at once

It's a bit long in the tooth now, but you probably could use POE::Component::Pcap (which sits on top of Net::Pcap) and let POE do the nasty socket-y-select-y bits.

Update: Hrmm, wait I glossed over where you need multiple pcap filters. Perhaps you could use all the filters as conditions (joined with 'or') and then figure out which hit for a given packet in your code?

The cake is a lie.
The cake is a lie.
The cake is a lie.

Comment on Re: Real time reading of multiple pcap 'instances' at once

Replies are listed 'Best First'.

Re^2: Real time reading of multiple pcap 'instances' at once
by JPaul (Hermit) on Nov 15, 2008 at 01:09 UTC

Although, due to what I'm trapping, I can't really pull the packets into perl and use it to work it out - they do happen to be, currently, all on different ports - which, of course, tcpdump clearly shows. I don't even need to mess with Net::Pcap and it's screwing with SIGALRM - I can simply use my existing implementation with a few extra nuts and bolts. I think.

Thank you for the probably obvious, but nevertheless gratefully received, suggestion.

-- Alexander Widdlemouse undid his bellybutton and his bum dropped off --

[reply]

In Section Seekers of Perl Wisdom