Oh, I see. Thanks for the explanation.

I guess I'm going to be quite naive here, but it sounds like you have what I would call a "traffic cop" application. You open a pcap file and read a packet, then decide where it should go, direct that traffic there. Get next packet, etc.

I'm not quite understanding why there is a need to store any significant amount of data at all - I mean why it's not possible to just decide on-the-fly where the packet should go rather than having to save them for processing later?

Sounds like these SIP packets determine when a call starts and when a call ends and that you can assign some kind of callid to that unique call. Further that the "inbetween packets" can also be easily id'ed as belonging to a particular call.

I don't know how many calls are in one pcap file. But it could be that you can just have filehandles open to all of them - Depends upon OS filehandle limits. Open a new file when you see a new call starting.

You could use a hash to map call-ids to file handles. Something like this: 

#!/usr/bin/perl -w
use strict;

my %filehandles;

foreach ('call1','call2')
{
   open my $fh, '>>', $_ or die "can't open $_ for append $!";
   $filehandles{$_}=$fh;
}

# use call_id in the print to select the right filehandle to
# write to

my $call_id = "call1";
print {$filehandles{$call_id}} "to file1\n";
$call_id = "call2";
print {$filehandles{$call_id}} "to file2\n";

[download]
Just trying to be helpful.

In reply to Re^3: dumping hashes to pcap files by Marshall
in thread dumping hashes to pcap files by bigmoose

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.