NAME

Net::Analysis::TCPSession - represent a TCP session (with two endpoints)

SYNOPSIS

  use Net::Analysis::TCPSession qw(:const);

  my $sesh = Net::Analysis::TCPSession->new ();

  foreach my $pkt (@packets) {
    my $ret = $sesh->process_packet ($pkt);
    ($ret) || die "broken session: ".$sesh->errstr();
    print " >> $sesh <<\n";

    if      ($ret == PKT_ESTABLISHED_SESSION) {
      print "new session established\n";

    } elsif ($ret == PKT_TERMINATED_SESSION) {
      print "session torn down\n";

    } elsif ($ret == PKT_FLIPPED_DIR) {
      print "monologue generated\n----\n".$sesh->previous_monologue();
    }
  }

  if ($sesh->has_current_monologue()) {
    print "final monologue\n----\n".$sesh->current_monologue();
  }

DESCRIPTION

Processes a packet in the context of an existing TCP session. This is the module that does the bulk of the stream management; SYNs, ACKs, dropping duplicates and storing out-of-sequence packets.

A packet, once placed in order, is considered to do just one of four things:

establish a new TCP session
add data to a TCP monologue (data travelling in one direction)
flip the direction of conversation (thus terminating existing monologue)
terminate the TCP session

EXPORT

None by default.

AUTHOR

Adam B. Worrall, <worrall@cpan.org>

COPYRIGHT AND LICENSE