How can I extract tcp links from pcap files with Perl ?

wildnature has asked for the wisdom of the Perl Monks concerning the following question:

My work is to analyze tcp links in my computer and store them to pcap files if they meets some criteria.

My plan is to use dumpcap to save pcap files, and use perl to extract tcp links from these pcap files and store the tcp links in pcap again (only include packets related to the link).

.My question is: which module can I use in CPAN to extract tcp links in pcap files ?

I try to use Net::Frame or Net::Packet but failed because these modules couldn't extract tcp links properly and also got problems when store the packet extracted from pcap files to another pcap files

Comment on How can I extract tcp links from pcap files with Perl ?

Replies are listed 'Best First'.
Re: How can I extract tcp links from pcap files with Perl ? by Anonymous Monk on Jan 17, 2011 at 04:54 UTC
what is a tcp link?	[reply]
Re^2: How can I extract tcp links from pcap files with Perl ? by wildnature (Novice) on Jan 17, 2011 at 07:12 UTC
alias for a complete tcp stream :)	[reply]
Re^3: How can I extract tcp links from pcap files with Perl ? by Anonymous Monk on Jan 17, 2011 at 08:51 UTC
alias for a complete tcp stream :) I would have never guessed that. Its best to stick to the terminology the inventors use, like tcp session or tcp conversation or tcp stream ... See Tutorials: Network Programming: Perl and Net::Pcap http://search.cpan.org/dist/Sniffer-HTTP/bin/dump-raw.pl pcap2mpeg TCP session recreation from pcap files The top two links are dead-on	[reply]