NetPacket::TCP(3)

✨ NetPacket::TCP ✨

okay bestie, gather round, because this is the manual page for NetPacket::TCP — a lil Perl module (part of the User Contributed Perl Documentation situation, and it's on perl v5.42.0, no biggie) that assembles and disassembles TCP (Transmission Control Protocol) packets. yes. THAT TCP. the one your wifi runs on. she's iconic, she's doing the most, and she's here to help you build and un-build packets. 💅

---

🌸 VERSION 🌸

version 1.8.0 — that's the one, don't come at me with anything older.

---

🦋 SYNOPSIS 🦋

use NetPacket::TCP;

$tcp_obj = NetPacket::TCP->decode($raw_pkt);
$tcp_pkt = $tcp_obj->encode($ip_pkt);
$tcp_data = NetPacket::TCP::strip($raw_pkt);

literally that's the whole vibe. three lines and you're a network engineer. 🫶

---

💖 DESCRIPTION 💖

So NetPacket::TCP gives you a lil set of routines for assembling and disassembling packets using TCP (Transmission Control Protocol). that's it. that's the job. she does it and she does it well. ✨

🎀 Methods 🎀

• NetPacket::TCP->decode([RAW PACKET]) — decode the raw packet data you hand over and return an object stuffed with instance data. ⚠️ heads up bestie: this method will quite happily decode garbage input. like, zero complaints, zero checks. it is 100% the programmer's responsibility to make sure valid packet data is what gets passed in. she trusts you. maybe don't abuse that trust. 😭
• NetPacket::TCP->encode($ip_obj) — return a TCP packet encoded with the instance data specified. she needs parts of the ip header that live inside $ip_obj so she can calculate the TCP checksum. no ip obj, no checksum, no packet. periodt.
• $packet->parse_tcp_options — returns a hash (or a hash ref if you're in scalar context) containing the packet's options. 🧚 right now this method only recognizes the well-known, widely used options: MSS, noop, windows scale factor, SACK permitted, SACK, and timestamp. if the packet has options this method doesn't know about, it may fail. so like. fair warning. 🙈

🌈 Functions 🌈

• NetPacket::TCP::strip([RAW PACKET]) — return the encapsulated data (aka the payload) contained in the TCP packet. this data is suitable to be used as input for other NetPacket::* modules, so it plays nice with the friend group. 💜 this function is equivalent to creating an object with the decode() constructor and then returning the data field of that object.

👑 Instance data 👑

The instance data for the NetPacket::TCP object consists of the following fields. main character fields only, obviously:

• src_port — the source TCP port for the packet.
• dest_port — the destination TCP port for the packet.
• seqnum — the TCP sequence number for this packet.
• acknum — the TCP acknowledgement number for this packet.
• hlen — the header length for this packet.
• reserved — the 6-bit "reserved" space in the TCP header. she's reserved. she's mysterious. she's not doing anything. 💀
• flags — contains the urg, ack, psh, rst, syn, fin, ece and cwr flags for this packet.
• winsize — the TCP window size for this packet.
• cksum — the TCP checksum.
• urg — the TCP urgent pointer.
• options — any TCP options for this packet, in binary form.
• data — the encapsulated data (payload) for this packet.

⭐ Exports ⭐

• default — FIN SYN RST PSH ACK URG ECE CWR. can be used to set the appropriate flag. slay.
• exportable — tcp_strip
• tags — the following tags group together related exportable items:
  • :strip — import the strip function tcp_strip.
  • :ALL — all the above exportable items. the whole menu. eat up. 🍓

---

🔥 EXAMPLE 🔥

The following script is a primitive pop3 sniffer. she's nosy but make it networking. 🕵️♀️

#!/usr/bin/perl -w

use strict;
use Net::PcapUtils;
use NetPacket::Ethernet qw(:strip);
use NetPacket::IP qw(:strip);
use NetPacket::TCP;

sub process_pkt {
    my($arg, $hdr, $pkt) = @_;

    my $tcp_obj = NetPacket::TCP->decode(ip_strip(eth_strip($pkt)));

    if (($tcp_obj->{src_port} == 110) or ($tcp_obj->{dest_port} == 110)) {
        print($tcp_obj->{data});
    }
}

Net::PcapUtils::loop(\&process_pkt, FILTER => 'tcp');

The following uses NetPacket together with Net::Divert to add a syn flag to all TCP packets passing through. yes, ALL of them. she is unhinged and we love her for it. 🌈

#!/usr/bin/perl

use Net::Divert;
use NetPacket::IP qw(IP_PROTO_TCP);
use NetPacket::TCP;

$divobj = Net::Divert->new('yourhostname',9999);

$divobj->getPackets(\&alterPacket);

sub alterPacket {
    my($packet,$fwtag) = @_;

    # decode the IP header
    $ip_obj = NetPacket::IP->decode($packet);

    # check if this is a TCP packet
    if($ip_obj->{proto} == IP_PROTO_TCP) {

        # decode the TCP header
        $tcp_obj = NetPacket::TCP->decode($ip_obj->{data});

        # set the syn flag
        $tcp_obj->{flags} |= SYN;

        # construct the new ip packet
        $ip_obj->{data} = $tcp_obj->encode($ip_obj);
        $packet = $ip_obj->encode;

    }

    # write it back out
    $divobj->putPacket($packet,$fwtag);
 }

---

💅 TODO 💅

things on the to-do list, aka the "not me procrastinating" list:

• Assembly of TCP fragments into a data stream
• Option processing
• Nicer processing of TCP flags

one day. maybe. the vibe check says not today. 😭

---

🫶 COPYRIGHT 🫶

Copyright (c) 2001 Tim Potter and Stephanie Wehner.

Copyright (c) 1995,1996,1997,1998,1999 ANU and CSIRO on behalf of the participants in the CRC for Advanced Computational Systems ('ACSys').

This module is free software. You can redistribute it and/or modify it under the terms of the Artistic License 2.0.

This program is distributed in the hope that it will be useful, but without any warranty; without even the implied warranty of merchantability or fitness for a particular purpose. (so like, use it, love it, but don't sue anyone if it goes sideways. 💀)

---

💜 AUTHOR 💜

• Tim Potter <tpot@samba.org>
• Stephanie Wehner <atrak@itsx.com>

---

okay that's the whole page, bestie. this lil doc was served up fresh on 2026-02-05 and it ships with perl v5.42.0. go decode something cute. byeee 💖✨🎀🦋🌸💅🫶