use strict;
use Net::TcpDumpLog;
use NetPacket::IP qw(:strip);
use NetPacket::TCP qw(:strip);
my $log = Net::TcpDumpLog->new();
$log->read($ARGV[0]);
my @Indexes = $log->indexes;
my $index;
my ($length_orig,$length_incl,$drops,$secs,$msecs);
my $data;
print ("IP SRC,IP DST, IP LENGTH, IP TOS, IP TTL, IP Offset, TCP ACK, TCP flags, TCP Winsize, TCP Chksum, TCP URG\n");
foreach $index (@Indexes) {
($length_orig,$length_incl,$drops,$secs,$msecs) = $log->header($index);
$data = $log->data($index);
my ($ether_dest,$ether_src,$ether_type,$ether_data) = unpack('H12H12H4a*',$data);
my $ip_obj = NetPacket::IP->decode($ether_data);
my $tcp_obj = NetPacket::TCP->decode( $ip_obj->{data});
print ("$i $ip_obj->{src_ip} ($tmpIPs),$ip_obj->{dest_ip} ($tmpIPd),$ip_obj->{len},$ip_obj->{tos},$ip_obj->{ttl},$ip_obj->{foffset},$tcp_obj->{acknum},$tcp_obj->{flags}, $tcp_obj->{winsize}, $tcp_obj->{cksum}, $tcp_obj->{urg}\n");
####
$perl -MNet::Analysis -e main TCP,v=7 google.dump
####
= ( 0 23:28:09.091264 163.1.236.180:47262-209.85.227.99:80) *AP SEQ:4094724362 ACK:3316076611 1072b
====[23:28:09.091264] tcp session start [163.1.236.180:47262 -> 209.85.227.99:80]
==[23:28:09.091264] [Mono from 163.1.236.180:47262] 0.000000s, 1pkts, 1072b
= ( 1 23:28:09.119041 209.85.227.99:80-163.1.236.180:47262) *A SEQ:3316076611 ACK:4094725434 1368b
= ( 2 23:28:09.119097 163.1.236.180:47262-209.85.227.99:80) _A
[......]
====[--:--:--.------] tcp session end [163.1.236.180:47263-209.85.227.99:80]