Net::F...Offline(3pm)

💖 Net::Frame::Dump::Offline — the manual, but make it make sense 💖

okay bestie, welcome to the perl docs for Net::Frame::Dump::Offline 🎀 part of the User Contributed Perl Documentation collection, no cap. It's a tcpdump-flavoured situation but for offline mode — like, reading packets out of a file instead of sniffing the air live. iykyk ✨

---

🌸 NAME 🌸

Net::Frame::Dump::Offline — a tcpdump-like implementation, but the offline mode version 🦋

---

✨ SYNOPSIS ✨

here's the whole vibe, bestie, code exactly as it comes:

use Net::Frame::Dump::Offline;

#
# Simple offline anaysis
#
my $oDump = Net::Frame::Dump::Offline->new(file => $file);

$oDump->start;

my $count = 0;
while (my $h = $oDump->next) {
   my $f = Net::Frame::Simple->new(
      raw        => $h->{raw},
      firstLayer => $h->{firstLayer},
      timestamp  => $h->{timestamp},
   );
   my $len = length($h->{raw});
   print 'o Frame number: '.$count++." (length: $len)\n";
   print $f->print."\n";
}

$oDump->stop;

#
# Default parameters on creation
#
my $oDumpDefault = Net::Frame::Dump::Offline->new(
   file          => "netframe-tmp-$$.$int.pcap",
   filter        => '',
   isRunning     => 0,
   keepTimestamp => 0,
);

(yes, anaysis is spelled like that in the original, we do not touch the code, we love her as she is 💅)

---

🦋 DESCRIPTION 🦋

This module is literally a tcpdump-like program, except it's built for offline analysis. You point it at packets you already have, it does the reading. main character energy, honestly 👑

---

💅 ATTRIBUTES 💅

these are the attributes that get inherited:

• file — the name of the .pcap file you want to read 📁
• filter — the Pcap filter you wanna use. defaults to no filter at all, she's unbothered ✨
• firstLayer — holds info about the type of the first layer sitting inside a read frame. heads up: this one only gets filled after you call the start method, so don't come for her early 🫶
• isRunning — returns true if a call to start has happened, and false otherwise — or false if a call to stop has happened. basically a little vibe check on whether she's running 🏃‍♀️
• keepTimestamp — okay so sometimes, when frames get captured and saved into a .pcap file, the timestamps suck 😭 like, you send a frame, you get the reply, but your request looks like it was sent after the reply?? rude. so to fix that whole mess, you can use Net::Frame::Dump's own timestamping system. the default is 0. set it manually to 1 if you actually need the original .pcap frame timestamps. your call, bestie 💜

---

🌈 METHODS 🌈

• new
• new (hash) — the object constructor 🎀 you can pass attributes in and they'll overwrite the default ones. peep the SYNOPSIS for the default values, they're all listed up there ⭐
• start — call this when you want to start reading frames from the file. go time 🔥
• stop — call this when you want to stop reading frames from the file. that's a wrap 💀
• next — returns the next captured frame; returns undef if there are no more frames waiting. no more, we're done, she's empty 🙈
• store (Net::Frame::Simple object) — this method stores the Net::Frame::Simple object you pass as a single parameter, internally and sorted. the getKey methods, which are implemented across various Net::Frame::Layer objects, get used to efficiently retrieve frames (via the getKeyReverse method). basically? it's what lets the recv method (from Net::Frame::Simple) quickly grab the reply frame for a request frame. speed. efficiency. slay 💅
• getFramesFor — this returns an array of the possible reply frames for the Net::Frame::Simple object you specify. like, for a UDP probe, the reply frames will be all the frames with the same source port and destination port as the request. matchy matchy 🧚
• flush — flushes the stored frames, aka the ones that got stored via the store method. bye bye frames 🫶

---

👑 SEE ALSO 👑

Net::Frame::Dump

---

💜 AUTHOR 💜

Patrice <GomoR> Auffret

---

🎀 COPYRIGHT AND LICENSE 🎀

Copyright (c) 2006-2020, Patrice <GomoR> Auffret

You may distribute this module under the terms of the Artistic license. See the LICENSE.Artistic file in the source distribution archive.

---

and that's the whole page, bestie — brought to you by perl v5.36.0, dated 2022-11-19 🌸 no cap, that's the version and the date, go forth and parse those packets 💖✨🦋