Given todays' earlier postings ([solved] Cant seem to print perl hash ... & Perl hashes revisit) by perlpreben, I have the distinct impression he might need a little more elaboration viz-a-vis the actual accessing of of the data - I would be only to pleased to help ... if only I knew something about the modules of which he & you both speak...

Haha, ... right on the money Bloodnok. Its been a busy day for me here on PerlMonks, .. and boy am I glad to have the super ninja perl gurus available to ask. Normally i do try to dig deep into docs and stuff before I ask too basic questions, but sometimes you just want to get progress going fast... hehe!

my $sniffer = Sniffer::HTTP->new(
          callbacks => {
                request  => sub {
                     my ($req,$conn) = @_;},
                response => sub { my ($res,$req,$conn) = @_;},
                log      => sub { print $_[0] if $VERBOSE },
                tcp_log  => sub { print $_[0] if $VERBOSE > 1 },
                
          },
timeout => 5*60, # seconds after which a connection is considered stal
+e
          stale_connection
            => sub { my ($s,$conn,$key);
                    
                    if ($key){
                     print "Connection stalled .... $key ....\n" if $d
+ebug;
                     $s->log->("Connection $key is stale.");
                     $s->remove_connection($key);
                     }
                     
                   },
        );
      
        $sniffer->run($interface);
[download]

Hmmm... It looks like I was wrong about callbacks. There's accessor methods src_host and dest_host in Sniffer::Connection class, but they don't work, actually Sniffer::HTTP just ignores information about hosts in packets. Sniffer::Connection module handles only TCP packets and doesn't receives any information about IP addresses. This is design issue, it's possible to fix but would require some work. So the only way to get addresses is to use handle_(eth|ip|tcp)_packet methods instead of run and extract addresses directly from packets, but that's not very convenient.

Update: perhaps it would require just fix handle_ip_packet function in Sniffer::HTTP, I'll see it tomorrow.

The source_port and dest_port are only set from the ->new_from_packet method, so you'd need that. I have never used Sniffer::HTTP with multiple connections to multiple hosts going on at the same time, and also didn't have the necessity in the upper layer to care about the IP addresses, so that part isn't really implemented (nor tested).