use strict; use Net::TcpDumpLog; use NetPacket::IP qw(:strip); use NetPacket::TCP qw(:strip); my $log = Net::TcpDumpLog->new(); $log->read($ARGV[0]); my @Indexes = $log->indexes; my $index; my ($length_orig,$length_incl,$drops,$secs,$msecs); my $data; print ("IP SRC,IP DST, IP LENGTH, IP TOS, IP TTL, IP Offset, TCP ACK, TCP flags, TCP Winsize, TCP Chksum, TCP URG\n"); foreach $index (@Indexes) { ($length_orig,$length_incl,$drops,$secs,$msecs) = $log->header($index); $data = $log->data($index); my ($ether_dest,$ether_src,$ether_type,$ether_data) = unpack('H12H12H4a*',$data); my $ip_obj = NetPacket::IP->decode($ether_data); my $tcp_obj = NetPacket::TCP->decode( $ip_obj->{data}); print ("$i $ip_obj->{src_ip} ($tmpIPs),$ip_obj->{dest_ip} ($tmpIPd),$ip_obj->{len},$ip_obj->{tos},$ip_obj->{ttl},$ip_obj->{foffset},$tcp_obj->{acknum},$tcp_obj->{flags}, $tcp_obj->{winsize}, $tcp_obj->{cksum}, $tcp_obj->{urg}\n"); #### $perl -MNet::Analysis -e main TCP,v=7 google.dump #### = ( 0 23:28:09.091264 163.1.236.180:47262-209.85.227.99:80) *AP SEQ:4094724362 ACK:3316076611 1072b ====[23:28:09.091264] tcp session start [163.1.236.180:47262 -> 209.85.227.99:80] ==[23:28:09.091264] [Mono from 163.1.236.180:47262] 0.000000s, 1pkts, 1072b = ( 1 23:28:09.119041 209.85.227.99:80-163.1.236.180:47262) *A SEQ:3316076611 ACK:4094725434 1368b = ( 2 23:28:09.119097 163.1.236.180:47262-209.85.227.99:80) _A [......] ====[--:--:--.------] tcp session end [163.1.236.180:47263-209.85.227.99:80]