File Coverage

blib/lib/Net/Inspect/L2/Pcap.pm

Criterion	Covered	Total	%
statement	7	9	77.7
branch			n/a
condition			n/a
subroutine	3	3	100.0
pod			n/a
total	10	12	83.3

use strict;
use warnings;

package Net::Inspect::L2::Pcap;
use Net::Pcap qw(pcap_datalink :datalink);
use base 'Net::Inspect::Flow';
use fields qw(offset);

sub new {
    my ($class,$pcap,$flow) = @_;
    my $linktype = ref($pcap) ? pcap_datalink($pcap) : $pcap;
    my $offset =
	($linktype == DLT_EN10MB)    ? 14 :
	($linktype == DLT_LOOP)      ?  4 :
	($linktype == DLT_NULL)      ?  4 :
	($linktype == DLT_LINUX_SLL) ? 16 :
	($linktype == DLT_RAW)       ?  0 :
	die "cannot handle linktype $linktype";

    my $self = $class->SUPER::new($flow);
    $self->{offset} = $offset;
    return $self;
}

sub pktin {
    my Net::Inspect::L2::Pcap $self = shift;
    my ($data,$hdr) = @_;
    if ( $hdr->{caplen} > $hdr->{len} ) {
	$data = substr($data,0,$hdr->{len});
    } elsif ( $hdr->{caplen} < $hdr->{len} ) {
	warn "packet truncated\n";
	return 1;
    }

    my $time = $hdr->{tv_sec} + $hdr->{tv_usec}/1000_000;
    $data = substr($data,$self->{offset}) if $self->{offset};

    $self->{upper_flow}->pktin($data,$time);
    return 1;
}
1;

__END__