If you want to *listen* rather than *speak*, I imagine your going to need the Net::Pcap module that interfaces with the pcap system library. Beyond that, you might want to try the NetPacket module collection to take care of packet decoding for you. Once you have the packets decoded down to the TCP level you can look at ports and other factors to determine if a given packet is indeed ftp traffic.

Alternatively you could use tcpdump to listen in and only report on FTP traffic. You could pipe this output into a file for later analysis, or right into a perl script for real-time analysis.

Cheers,

- danboo

In reply to Re: FTP packets by Anonymous Monk
in thread FTP packets by curtisb

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.