NAME

Net::Analysis::TCPSession - represent a TCP session (with two endpoints)

SYNOPSIS

  use Net::Analysis::TCPSession qw(:const);
  my $sesh = Net::Analysis::TCPSession->new ();
  foreach my $pkt (@packets) {
    my $ret = $sesh->process_packet ($pkt);
    ($ret) || die "broken session: ".$sesh->errstr();
    print " >> $sesh <<\n";
    if      ($ret == PKT_ESTABLISHED_SESSION) {
      print "new session established\n";
    } elsif ($ret == PKT_TERMINATED_SESSION) {
      print "session torn down\n";
    } elsif ($ret == PKT_FLIPPED_DIR) {
      print "monologue generated\n----\n".$sesh->previous_monologue();
    }
  }
  if ($sesh->has_current_monologue()) {
    print "final monologue\n----\n".$sesh->current_monologue();
  }

DESCRIPTION

Processes a packet in the context of an existing TCP session. This is the module that does the bulk of the stream management; SYNs, ACKs, dropping duplicates and storing out-of-sequence packets.

A packet, once placed in order, is considered to do just one of four things:

• establish a new TCP session
• add data to a TCP monologue (data travelling in one direction)
• flip the direction of conversation (thus terminating existing monologue)
• terminate the TCP session

SEE ALSO

AUTHOR

Adam B. Worrall, <worrall@cpan.org>

COPYRIGHT AND LICENSE

Copyright (C) 2004 by Adam B. Worrall

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.5 or, at your option, any later version of Perl 5 you may have available.