in reply to filter tcpdump packets

The documentation is pretty thin, but looking at the source of NetPacket::TCP, I think you need to call my %opts = $tcp_obj->parse_tcp_options; and then access $opts{mss}. (untested)

I've attempted to work with libpcap in the past myself, using both Perl and Java. Several times I've come away with an icky feeling. That leads me to ask: why do you want to do this with Perl, and not with tshark?

Replies are listed 'Best First'.
Re^2: filter tcpdump packets
by syboar (Novice) on Sep 01, 2014 at 03:12 UTC
    		[reply]
        Tshark is another application that identical to Tcpdump

        No, it's much more powerful - have a look again at the tshark manpage, especially the -T fields and -e options. You can use them to output Wireshark's tcp.options.mss_val field.

        As for your output, it looks like the packets don't contain an MSS option, or, if you know the packets do have one, NetPacket::TCP isn't parsing them correctly, in that case file a bug with the module.

    		[reply]
    [d/l]
    [select]
          You can use them to output Wireshark's tcp.options.mss_val field.

          Agreed Tshark will be helpful and more easy to implement wireshark filters. My understanding was Tshark is used with Java. Identical to Tcpdump for Perl. Definitely give a try to use Tshark in Perl. There's a Tshark PM too. I've been parsing input pcap file that don't contain mss option. here is the output with mss option.

          Thank you

          ===output===

          $VAR1 = {
          'sack' => 2,
          'mss' => 1460,
          'ws' => 8
        };

          [download]

          ===output===

    		[reply]
    [d/l]
    Re^2: filter tcpdump packets
    by syboar (Novice) on Sep 01, 2014 at 22:08 UTC
      		[reply]

          Net::Tshark had what amounts to a single release two years ago and has no tests. That makes it hard to tell how reliable that module is.

          not sure it's correct way to get mss options

          Have you tried looking at the data structure with Data::Dumper?

          map {$_ ->{mss}->{1500} } ...

          Without knowing the data structure, I'm going to wager a guess that maybe you need to do something like grep { $_->...->{mss}==1500 } @packets, where ... depends on the data structure you see with Data::Dumper.

          However, I'm still not sure why you're not simply doing something like this, where you are free to customize the display filter and output format without some module in between:

          my @cmd = ('tshark','-r',$PCAPFILE,
    qw# -R tcp.options.mss -T fields -e ip.src -e tcp.srcport
    -e ip.dst -e tcp.dstport -e tcp.options.mss_val #);
open my $ts, '-|', @cmd or die "Error opening pipe: $!";
while(<$ts>) {
    chomp;
    my ($src_addr,$src_port,$dst_addr,$dst_port,$mss) = split /\t/;
    print "$src_addr:$src_port -> $dst_addr:$dst_port  MSS=$mss\n";
}
close $ts or die $! ? "Error closing pipe: $!"
    : "Exit status \$?=$? from pipe";

          [download]

          (Or, look at IPC::Run to execute tshark, which is all that Net::Tshark is doing anyway.)

      		[reply]
      [d/l]
      [select]
        		[reply]

        In Section Seekers of Perl Wisdom