File Coverage

blib/lib/Net/Inspect.pm
Criterion Covered Total %
statement 6 6 100.0
branch n/a
condition n/a
subroutine 2 2 100.0
pod n/a
total 8 8 100.0


line stmt bran cond sub pod time code
1 1     1   412 use strict;
  1         1  
  1         22  
2 1     1   4 use warnings;
  1         1  
  1         51  
3             package Net::Inspect;
4              
5             our $VERSION = "0.326";
6             1;
7              
8              
9             =head1 NAME
10              
11             Net::Inspect - library for inspection of data on various network layers
12              
13             =head1 SYNOPSIS
14              
15             use Net::Pcap 'pcap_loop';
16             use Net::Inspect::L2::Pcap;
17             use Net::Inspect::L3::IP;
18             use Net::Inspect::L4::TCP;
19             use Net::Inspect::L7::HTTP;
20             use Net::Inspect::L7::HTTP::Request::InspectChain;
21             use Net::Inspect::Debug;
22              
23             my $pcap = Net::Pcap->new...
24             ...
25             my $l7 = Net::Inspect::L7::HTTP->new;
26             my $l4 = Net::Inspect::L4::TCP->new($l7);
27             my $l3 = Net::Inspect::L3::IP->new($l4);
28             my $l2 = Net::Inspect::L2::Pcap->new($pcap,$l3);
29              
30             pcap_loop($pcap,-1,sub {
31             my (undef,$hdr,$data) = @_;
32             return $l2->pktin($data,$hdr);
33             });
34              
35             =head1 DESCRIPTION
36              
37             The idea of L is to plug various layers of network inspection
38             together to analyze data.
39             This is kind of what wireshark or IDS do, exept this is in perl and
40             therefore slower to execute but faster to develop and maybe more flexibel
41             too.
42              
43             One can start analysis on some level and stop it at any higher level.
44             There are various useful tools in tools/ which make use of this library:
45              
46             =over 4
47              
48             =item tcpflow
49              
50             gets data from pcap file or does live capture and extracts tcp connections
51             into separate files.
52              
53             =item httpflow
54              
55             gets data from pcap file or does live capture and extracts http requests
56             into separate files. Does request unchunking and decompression. Works with
57             persistant and with pipelined HTTP connections.
58              
59             =item http_inspection_proxy
60              
61             simple http(s) proxy with the ability to inspect and transform requests.
62             Contrary to L and L it starts analysis at the TCP
63             layer, not at the pcap layer.
64              
65             Because of non-blocking DNS lookups and connects and DNS caching the proxy
66             is fast enough to be used in simple production setups. It can also store
67             each http connections as a single pcap file for more analysis.
68              
69             =back
70              
71             Currently the following modules are implemented:
72              
73             =over 4
74              
75             =item L
76              
77             reads from pcap layer
78              
79             =item L
80              
81             processes raw IP packets, does defragmentation.
82              
83             =item L
84              
85             handles TCP connections, e.g. connection setup and shutdown and reordering
86             of packets.
87              
88             =item L
89              
90             handles UDP packets. Can aggregate udp packets in virtual connections.
91              
92             =item L
93              
94             tries to guess the higher level protocol from TCP connections.
95              
96             =item L
97              
98             handles HTTP connections. Plugable into L.
99              
100             =item L
101              
102             handles connections which don't transport any data.
103             Plugable into L.
104              
105             =item L
106              
107             used together with L as a fallback if no
108             other protocol handler matched.
109              
110             =back
111              
112             =head1 BUGS
113              
114             Probably still a lot.
115             The HTTP part was tested with a lot of real-life traffic, so it should be
116             kind of stable. There is currently no support for IPv6.
117              
118             =head1 SEE ALSO
119              
120             L
121             L
122              
123             =head1 AUTHOR
124              
125             Steffen Ullrich,
126              
127             =head1 COPYRIGHT
128              
129             Copyright 2011-2013 Steffen Ullrich
130              
131             This library is free software; you can redistribute it and/or modify it
132             under the same terms as Perl itself.