Click here to get back home

Parse tcpdump for HTTP Request Response Headers

 HomeNewsGroups | Search | About
 comp.lang.perl.modules    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Parse tcpdump for HTTP Request Response Headers Raja 07-29-2007
Posted by Raja on July 29, 2007, 2:10 pm
Please log in for more thread options


Hi,

Iam pretty new to Perl. I have a requirement of parsing tcpdump file
to extract HTTP Request/Response headers, corresponding to successful
requests that have query strings. This, I have done using the
Net::Analysis package. But I have the additional requirement of
writing out the headers to different files based on the server program
being requested (like...all requests/responses corresponding to
example.com/login.pl, should go to one file).

I realised that the command:
perl -MNet::Analysis -e main HTTP Example3.pm tcpdump.file

invokes the .pm file for each line of the dump file. I was initially
thinking of opening one file handle for each unique server program and
writing the headers accordingly...But if the .pm file is invoked per
line of the input file, this does not seem possible. Iam very new to
Perl and am not able to think of the best way to get this done. Could
you please help me out in this regard? I have pasted below the simple
parser which reads the tcpdump file and prints out the request/
response headers for successful requests with query strings.

Thanks a lot,
Raj



use strict;
use warnings;
use base qw(Net::Analysis::Listener::Base);
use URI;
use URI::QueryParam;

sub http_transaction {
my ($self, $args) = @_;
my ($req) = $args->; # isa HTTP::Request
my ($resp) = $args->; # isa HTTP::Response
my $u;

# if ( $args-> ) { printf "%s\n", $req->as_string; }
# if ( $args-> ) { printf "%s\n", $resp-
>headers_as_string; }

if ( $args-> && $args-> && (lc($req->method) eq "get"))
{
$u = URI->new($req->uri, "http");
if ( $u->query && ($resp->code >= 200 && $resp->code < 300))
{
print $req->as_string,"\n";
print $resp->headers_as_string,"\n";
print "Method: ", $req->method,"\n";
print "URI: ", $req->uri,"\n";
print "QUERY: ", $u->query,"\n";
for my $key ($u->query_param) {
print "$key: ", join(", ", $u->query_param($key)), "\n";
}
}
}
}

1;


Similar ThreadsPosted
Net::Analysis Parse tcpdump for HTTP Request/Response Headers July 29, 2007, 6:41 am
http request headers October 1, 2004, 12:47 pm
http headers with CGI.pm and mod_perl (bug?) November 10, 2004, 10:19 pm
HTTP::Response decoded_content is undefined March 28, 2007, 8:04 am
fails to parse the soap request April 28, 2006, 7:35 pm
Help regarding HTTP::Request:POST February 24, 2006, 11:31 pm
HTTP::Request::Common::POST and UTF-8 September 27, 2005, 12:21 pm
troubles with HTTP::Request::Common March 8, 2005, 11:42 pm
How can I make HTTP::Request handle gzipped content? September 3, 2004, 2:11 am
HTTP::Request::Form - Problem pressing input type=image button February 1, 2005, 7:56 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap