NAME

Net::Analysis::TCPMonologue - simple class to contain a TCP monologue

SYNOPSIS

  use Net::Analysis::Packet;
  use Net::Analysis::Monologue;

  my $mono = Net::Analysis::Monologue->new();
  $mono->add_packet($pkt);

  if ($mono->data() =~ /foo/) {
    print "Mono contained 'foo'\n";
  }

  print "Monologue was " .$mono->length().
        "b long, over "  .$mono->t_elapsed ()." seconds\n";

DESCRIPTION

A TCP monologue is a series of packets that travel in one direction, e.g. a HTTP response. A monologue ends when a data packet travels in the other direction. Pairs of monologues will often be linked as transactions.

As packets are added, this object updates some info. It assumes that the packet you've added belongs in the monologue, and that you're adding them in the correct order.

The payload of the monologue lives in "$mono-"{data}>.

METHODS

new ( )

Takes no arguments.

add_packet ($pkt)

Adds any data, increments the packet counter, and keeps note of the time.

add_mono ($other_mono)

Walks through the packets in $other_mono, and adds each one to $self.

data ()

The actual data of the monologue; the bytes sent.

t_start ()

Returns an object representing the time the monologue started. Can be treated like a float, giving fractional epoch seconds. Only accurate to the microsecond.

t_end ()

Same as "t_start()", but giving the time the monologue ended (or the last packet so far, if you call it before the monologue has ended.)

t_elapsed ()

Returns an object representing "t_end - t_start" for this monologue. Can be treated like a float, giving duration in fractional seconds.

n_packets ()

How many data packets were in the monologue.

length ()

How long the monologue data was, in bytes. Excludes all the various packet headers.

first_packet ()

Returns the first Net::Analysis::Packet in the monologue. You can use it to extract any TCP or IP information about the monologue.

which_pkts ($byte_offset_start [, $byte_offset_end])

Given a byte offset from within the monologue, and optionally an offset later in the monologue, return the packets which contributed bytes between the offsets (or an empty arrayref if none found). Bytes are counted from zero (i.e. offset '0' would be the first byte).

This can be useful to retrieve timestamps of areas inside long-lived monologues.

socketpair_key ()

Returns the socketpair key of the TCP session containing the monologue.

_data_packets ()

Returns an array-ref, containing all the packets which contributed data to the monologue.

NOTE: this method may go away sometime.

EXPORT

None by default.

AUTHOR

Adam B. Worrall, <worrall@cpan.org>

COPYRIGHT AND LICENSE

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.5 or, at your option, any later version of Perl 5 you may have available.