Parsing tcpdump Files

ketema has asked for the wisdom of the Perl Monks concerning the following question:

Hello monks, I was wondering if anyone had experience using perl to analyze tcpdump logs, specifically those created by ethereal. I have found the module Net::TcpDumpLog, and would like to know if I will be able to perform the following with it:

1)Parse a log and search for files by name|extension|type
2)Extract and save files found through 1.
3)For Http data extract the complete request url for any files found via 1.

I have a lot of reading ahead of me, so if anyone has performed duties like these and has scripts available that would be nice, but even with no scripts comments on whether or not I'm in the right starting place would be of assistance as well. Thanks!

Comment on Parsing tcpdump Files

Replies are listed 'Best First'.
Re: Parsing tcpdump Files by planetscape (Chancellor) on Oct 28, 2005 at 19:23 UTC
I believe some of the replies to converting tcpdump output might be helpful. HTH, planetscape	[reply]
Re: Parsing tcpdump Files by cazz (Pilgrim) on Oct 28, 2005 at 19:58 UTC
You want Net::Pcap. Though, you might be better off using some other tools such as dsniff to find files/URLS.	[reply]