in reply to Re: yet another pcap question
in thread yet another pcap question

hi guys, thanks for the replies
I will try your suggestions.. but i am guessing raw inspection of pcap file by just pure perl is not recommended(hard to do? stupid to do? impossible to do? counterproductive to do? all of the above?)

Replies are listed 'Best First'.
Re^3: yet another pcap question
by jethro (Monsignor) on Feb 09, 2010 at 22:35 UTC

    None of the above. It is just more convenient to either use a library (that is already nice, shiny and debugged) or some already preprocessed data (which the PDML mykl talked about probably is. Also might be safer to parse because of added redundancy. And there are lots of XML parsers ready to use).

    Parsing binary data is not really hard, but the program tends to be a bit more unreadable and cryptic than a text parser because you have to use constants like '\x02'