Net::Inspect::L3::IP(3)

NAME
Net::Inspect::L3::IP - get raw IP packets, reassemble fragments

SYNOPSIS
 my $raw = Net::Inspect::L3::IP->new($tcp);
 $raw->pktin($data,$timestamp);

DESCRIPTION
Gets Raw-IP packets via "pktin" hook, extracts meta-data, reassembles fragmented packets and calls "pktin" hook on attached flows, once for each full packet.

Provides the hooks required by "Net::Inspect::L2::Pcap". Usually "Net::Inspect::L4::TCP" or similar are used as upper flow.

Constructor:

new(%args)
    The only used argument is %args is "timeout", which specifies when timeout in seconds, after which the next fragment of a packet must be received. Defaults to 60.

Hooks provided:

pktin($data,$timestamp)

Hooks called:

pktin($ip_data,\%meta)
    The following meta data are given:

    time
        time when the last fragment of the packet was received. Like time_t, but double.

    saddr, daddr
        the addresses of the sender and destination of the packet

    proto
        protocol of the packet

    id  id of the packet

    qos QoS flags of the packet

    ttl TTL counter of the packet

    fragments
        number of fragments or undef if packet wasn't fragmented

LIMITS
for now only IPv4 is implemented